Is there an easy way to check if a binary is 32 or 64 bit on Windows? I need to check before I move the program to a 32bit machine and experience a spectacular failure.
Answer
After examining header values from Richard's answer, I came up with a solution which is fast, easy, and only requires a text editor. Even Windows' default notepad.exe would work.
Open the executable in text editor. You might have to drag-and-drop or use the editor's
Open...dialog, because Windows doesn't showOpen with...option in context menu for executables.Check the first printable characters after the first occurrence of
PE. This part is most likely to be surrounded by at least some whitespace (could be a lot of it), so it can be easily done visually.
Here is what you're going to find:
32-bit:
PE L
64-bit:
PE d†
A word of warning: using default Notepad on big files can be very slow, so better not use it for files larger than a megabyte or few. In my case in took about 30 seconds to display a 12 MiB file. Notepad++, however, was able to display a 120 MiB executable almost instantly.
This is solution might be useful in case you need to inspect a file on a machine you can't install any additional software on.
If you have a HEX-Editor available, the offset of PE Signature is located at offset 0x3C. The signature is PE\0\0 (letters "P" and "E" followed by two null bytes), followed by a two byte Machine Type in Little Endian.
The relevant values are 0x8664 for a 64-bit executable and 0x014c for a 32-bit one (64 86 and 4c 01 respectively when adjusted for endianness, but any decent hex editor will automatically handle endianness when you search for a hex value). There are a lot more possible values, but you probably won't ever encounter any of these, or be able to run such executables on your Windows PC.
Full list of machine types, along with the rest of .exe specifications, can be found in Microsoft PE and COFF Specification Machine Types section.
No comments:
Post a Comment