Where/how does ILSpy identify the target framework?

[MV10]

I use ILSpy almost daily, generally for identifying bugs in other people's code pulled from memory crash dumps.

I have noticed that ILSpy pretty reliably identifies target frameworks and even correctly identifies things like .NET Standard DLLs with correct version numbers. I'm curious how this is done, the generally popular answers relying on TargetFrameworkAttribute (or worse, the CLR-oriented ImageRuntimeVersion property) are unreliable at best. I have even seen approaches that search the raw binary file data with regex. (I actually need to determine target frameworks via Powershell, and it's unlikely our locked-down corporate environment would allow me to deploy parts of ILSpy or whatever it uses, but I'm hoping the code and techniques might give me some ideas.)

Any chance someone can point me to the location in the source where ILSpy figures that out?

[dgrunwald]

ILSpy uses some mixture of the TargetFrameworkAttribute and the assembly references:

ILSpy/ICSharpCode.Decompiler/Metadata/DotNetCorePathFinderExtensions.cs

Line 48 in 4aaf452

public static string DetectTargetFrameworkId(this MetadataReader metadata, string assemblyPath = null)