How to detect that a given PE file (exe or dll) is 64 bit or 32 bit

Question

I need to detect whether a given .dll or .exe file is 32 bit or 64 bit

At the moment I have only one solution: read the PE Header from the specified file and take the 'Machine' field from there.

( Specification: Microsoft Portable Executable and Common Object File Format Specification (.docx file) at section "3.3. COFF File Header (Object and Image)" )

This field can take up to about 20 values. Three of them are:

IMAGE_FILE_MACHINE_I386  ( == 32bit )

IMAGE_FILE_MACHINE_IA64  ( == 64bit )

IMAGE_FILE_MACHINE_AMD64 ( == 64bit )

My questions:

1) Is 'Machine' to bitness mapping correct or did I miss something? Are there any other caveats?

2) Is there easier way to detect 32/64 bitness (probably some specific field in PE format I didn't notice or some special system function)?

dup: http://stackoverflow.com/questions/971689/win32-api-to-tell-whether-a-given-binary-exe-or-dll-is-x86-x64-or-ia64/971715#971715 — Shay Erlichmen, Jul 20 '09 at 11:47
That other question is asking about architecture, this one is asking about word size. — Draemon, Jul 20 '09 at 11:57
Documentation is updated from v8 to v11 as of now in 2017: http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx — kayleeFrye_onDeck, May 02 '17 at 00:43

score 16 · Accepted Answer · answered Jul 20 '09 at 11:57

16

GetBinaryType(...) returns SCS_32BIT_BINARY for a 32-bit Windows-based application and SCS_64BIT_BINARY for a 64-bit Windows-based application.

answered Jul 20 '09 at 11:57

Draemon

4

This unfortunately returns 0 when analyzing a DLL. – Benoit Dec 16 '10 at 08:12
Made it in Python: import win32file; print win32file.GetBinaryType("myfile.exe"). This returns 0 for 32bits exe or 6 for 64 bits file. – Jerome Vacher Aug 18 '15 at 16:28
This function fails when loading a non-matching arch (e.g. 64-bit DLL in 32-bit program). – Tamás Szelei Aug 11 '20 at 16:54

score 3 · Answer 2 · answered Nov 11 '11 at 22:21

3

Check this: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx Look for "Magic" member - you can find out whether PE header is 32 bit(PE32) or 64 bit(PE32+).

answered Nov 11 '11 at 22:21

Samuel

2 Answers2