Как проверить, является ли двоичный файл 32-разрядным или 64-разрядным в Windows?

After examining header values from Richard's answer, I came up with a solution which is fast, easy, and only requires a text editor. Even Windows' default notepad.exe would work.

1. Open the executable in text editor. You might have to drag-and-drop or use the editor's Open... dialog, because Windows doesn't show Open with... option in context menu for executables.

2. Check the first printable characters after the first occurrence of PE. This part is most likely to be surrounded by at least some whitespace (could be a lot of it), so it can be easily done visually.

Here is what you're going to find:

x86:

PE L 

x64:

PE d† 

A word of warning: using default Notepad on big files can be very slow, so better not use it for files larger than a megabyte or few. In my case in took about 30 seconds to display a 12 MiB file. Notepad++, however, was able to display a 120 MiB executable almost instantly.

This is solution might be useful in case you need to inspect a file on a machine you can't install any additional software on.

Additional info:

If you have a HEX-Editor available, the offset of PE Signature is located at offset 0x3C. The signature is PE\0\0 (letters "P" and "E" followed by two null bytes), followed by a two byte Machine Type in Little Endian.

The relevant values are 0x8664 for x64 executable and 0x14c for x86. There are a lot more possible values, but you probably won't ever encounter any of these, or be able to run such executables on your Windows PC.

Full list of machine types, along with the rest of .exe specifications can be found in Microsoft PE and COFF Specification Machine Types section.

Инструмент SDK dumpbin.exeс /headersопцией включает эту информацию, сравните эти два (я добавил жирный шрифт для ключевой информации)

PS [64] E: \ # 4> свалка / заголовки C: \ Windows \ system32 \ cmd.exe Microsoft (R) COFF / PE Dumper Версия 10.00.40219.01 Авторское право (C) Microsoft Corporation. Все права защищены.   Дамп файла C: \ Windows \ system32 \ cmd.exe  PE подпись найдена  Тип файла: EXECUTABLE IMAGE  Значения заголовка файла 8664 машина (x64) 6 количество секций 4CE798E5 отметка времени даты сб 20 ноября 09:46:13 2010 0 указатель файла на таблицу символов 0 количество символов Размер F0 необязательного заголовка 22 характеристики исполнимый Приложение может обрабатывать большие (> 2 ГБ) адреса [...] 

а также

PS [64] E: \ # 5> свалка / заголовки C: \ Windows \ syswow64 \ cmd.exe Microsoft (R) COFF / PE Dumper Версия 10.00.40219.01 Авторское право (C) Microsoft Corporation. Все права защищены.   Дамп файла C: \ Windows \ syswow64 \ cmd.exe  PE подпись найдена  Тип файла: EXECUTABLE IMAGE  Значения заголовка файла 14C машина (x86) 4 количество разделов 4CE78E2B отметка времени даты сб 20 ноября 09:00:27 2010 0 указатель файла на таблицу символов 0 количество символов E0 размер необязательного заголовка 102 характеристики исполнимый 32-битный словарь [...] 

Если у вас нет или вам не нужен весь Windows SDK или Visual Studio, вы можете использовать sigcheck.exeиз SysInternals :

sigcheck.exe C:\Windows\Notepad.exe 

Выход:

Sigcheck v2.1 - File version and signature viewer Copyright (C) 2004-2014 Mark Russinovich Sysinternals - www.sysinternals.com  c:\windows\notepad.exe: Verified: Signed Signing date: 8:59 AM 8/22/2013 Publisher: Microsoft Windows Description: Notepad Product: Microsoft« Windows« Operating System Prod version: 6.3.9600.16384 File version: 6.3.9600.16384 (winblue_rtm.130821-1623) MachineType: 64-bit 

I can confirm that the file utility (e.g. from cygwin) will distinguish between 32- and 64-bit executables. They appear as follows:

32.exe: PE32 executable (GUI) Intel 80386, for MS Windows 64.exe: PE32+ executable (console) x86-64, for MS Windows 

As you can see, it's very obvious which is which. Additionally it distinguishes between console and GUI executables, also obvious which is which.

Простой способ - запустить его (если вы доверяете ему) и взглянуть на вкладку процесса в диспетчере задач. 32-битные процессы покажут «* 32» в конце имени процесса. Если вы не хотите запускать его на своем компьютере, попробуйте EXE Explorer . Он покажет целую кучу информации об исполняемых файлах, в том числе 32 или 64-битные.

Many people have the excellent 7-zip installed, and have added the 7-Zip folder to their PATH. 7-zip understands file formats other than ZIP and RAR, such as MSI files and PE executables. Simply use the command line 7z.exe on the PE file (Exe or DLL) in question:

7z l some.exe | more 7z l some.exe | findstr CPU 

Output will include lines as follows, with the CPU line reading either x86 or x64, which is what is being asked here:

Path = C:\Extra\AV\neroAacEnc.exe Type = PE CPU = x86 Characteristics = Executable 32-bit Path = C:\Extra\AV\LAME\lame_enc.dll Type = PE CPU = x86 Characteristics = Executable DLL 32-bit Path = C:\Extra\AV\FFmpeg\bin\ffmpeg.exe Type = PE CPU = x64 64-bit = + Characteristics = Executable LargeAddress NoRelocs NoLineNums NoLocalSyms NoDebugInfo Path = C:\Extra\AV\FFmpeg\bin\avcodec-56.dll Type = PE CPU = x64 64-bit = + Characteristics = Executable DLL LargeAddress NoLineNums NoLocalSyms NoDebugInfo 

64-разрядная версия Process Explorer может сказать вам. Просто запустите исполняемый файл и откройте окно свойств процесса. На главной вкладке есть запись с надписью «Изображение: 32-разрядная» или «Изображение: 64-разрядная».

Самый простой способ (когда данные не являются конфиденциальными)

Я считаю, что Virustotal File detail - это самый простой способ выяснить, является ли двоичный файл 32-разрядным или 64-разрядным.

Additional informationВариант предусматривает в дополнении много полезных информации о файле.

The method of running an executable & then checking in process explorer or similar tool, has some obvious drawbacks:

1. We have to execute the process.
2. For the short lived processes (like echo hello world types.), process explorer might not even register that a new process has started.

Dumpbin.exe method can solve the purpose probably.

Another alternative would be to use cygwin's file command. However, I have not tested it on windows. It works well on Linuxes.

Usage: file program_under_test.exe 

EDIT: Just tested file.exe on window. works fine. :)

Here's a Powershell solution, no external dependencies or anything. Open Powershell, paste the function in there (hit Enter twice so that you return to the prompt), then use it as in my examples below the function:

function Test-is64Bit { param($FilePath=“$env:windir\notepad.exe”) [int32]$MACHINE_OFFSET = 4 [int32]$PE_POINTER_OFFSET = 60 [byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096 $stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($FilePath, 'Open', 'Read') $stream.Read($data, 0, 4096) | Out-Null [int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET) [int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET) $stream.Close() $result = "" | select FilePath, FileType, Is64Bit $result.FilePath = $FilePath $result.Is64Bit = $false switch ($machineUint) { 0 { $result.FileType = 'Native' } 0x014c { $result.FileType = 'x86' } 0x0200 { $result.FileType = 'Itanium' } 0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; } } $result } 

Here's example output:

D:\> Test-is64bit FilePath FileType Is64Bit -------- -------- ------- C:\Windows\notepad.exe x64 True D:\> Test-is64bit 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe' FilePath FileType Is64Bit -------- -------- ------- C:\Program Files (x86)\Mozilla Firefox\firefox.exe x86 False