522

Is there an easy way to check if a binary is 32- or 64-bit on Windows? I need to check before I move the program to a 32-bit machine and experience a spectacular failure.

3

32 Answers 32

635

After examining header values from Richard's answer, I came up with a solution which is fast, easy, and only requires a text editor. Even Windows' default notepad.exe would work.

  1. Open the executable in a text editor. You might have to drag-and-drop or use the editor's Open... dialog, because Windows doesn't show Open with... option in the context menu for executables.

  2. Check the first printable characters after the first occurrence of PE. This part is most likely to be surrounded by at least some whitespace (could be a lot of it), so it can be easily done visually.

Here is what you're going to find:

32-bit:

PE  L

64-bit:

PE  d†

A word of warning: using default Notepad on big files can be very slow, so better not use it for files larger than a megabyte or a few. In my case, it took about 30 seconds to display a 12 MiB file. Notepad++, however, was able to display a 120 MiB executable almost instantly.

This is solution might be useful in case you need to inspect a file on a machine you can't install any additional software on.

Additional info:

If you have a HEX-Editor available, the location of PE Signature is located at offset 0x3C. The signature is PE\0\0 (letters "P" and "E" followed by two null bytes), followed by a two-byte Machine Type in Little Endian.

The signature is usually further ahead in MZ files.

The relevant values are 0x8664 for a 64-bit executable and 0x014c for a 32-bit one (64 86 and 4c 01 respectively when adjusted for endianness, but any decent hex editor will automatically handle endianness when you search for a hex value). There are a lot more possible values, but you probably won't ever encounter any of these, or be able to run such executables on your Windows PC.

Full list of machine types, along with the rest of .exe specifications, can be found in Microsoft PE and COFF Specification Machine Types section.

27
  • 9
    Rare instance when notepad beat notepad++. Notepad shows this right, in notepad you have mess around with encoding to get it to show but it worked! Commented Dec 8, 2015 at 20:01
  • 4
    @CoDEmanX this option means the IDE or JIT makes the choice for you. See this question or this blog post for more details. Commented Aug 1, 2016 at 11:30
  • 4
    @IInspectable if you had actually bothered to read the whole post before downvoting it, you would have seen the link to Microsoft PE and COFF Specification, which is as much a documented contract as it can get, as well as instructions on how to find the exact address of PE header in any .exe file. If you have a more reliable source than Microsoft's official specification on Microsoft's own executable format, I would love to know what that is. Commented Jan 21, 2017 at 10:07
  • 21
    For files that start with "MZ", you need to look a bit further. I found PE..L at offset 0x110, just after "RichMQ_........". Commented May 24, 2018 at 4:20
  • 2
    Thanks for the technique! It works for me, but note that this statement in your answer "the offset of PE Signature is located at offset 0x3C" is not always correct. Doxygen 32-bit EXE for example has PE header @ 0x108. In case anyone's interested this command will help apply this technique on linux: hexdump -C <file> | grep 'PE' | head -n 5 (gives first 5 matches of 'PE' in the file) Commented Nov 17, 2019 at 0:52
179

The SDK tool dumpbin.exe with the /headers option includes this information, compare these two (I've added bold for the key information)

PS [64] E:\ #4> dumpbin /headers C:\Windows\system32\cmd.exe
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\system32\cmd.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
            8664 machine (x64)
               6 number of sections
        4CE798E5 time date stamp Sat Nov 20 09:46:13 2010
               0 file pointer to symbol table
               0 number of symbols
              F0 size of optional header
              22 characteristics
                   Executable
                   Application can handle large (>2GB) addresses
[...]

and

PS [64] E:\ #5> dumpbin /headers C:\Windows\syswow64\cmd.exe
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\syswow64\cmd.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4CE78E2B time date stamp Sat Nov 20 09:00:27 2010
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine
[...]
8
  • 2
    You could also see (IA64) for a 64bit Itanium exe. Commented Nov 17, 2011 at 17:01
  • 33
    as i read elsewhere on superuser, using dumpbin /headers | findstr "machine" greatly simplifies the presentation of what the QA is looking for... Commented Mar 17, 2013 at 14:10
  • 7
    Dumpbin.exe is located here: C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\bin Commented Jul 30, 2014 at 11:12
  • 5
    @David: not necessarily (different version of VS, not using the default install location, using version from the Windows SDK): that is why I didn't specify. Commented Jul 30, 2014 at 11:17
  • 9
    It's easiest to use dumpbin if you launch it from the visual studio command-line: stackoverflow.com/a/477389/1390430 Commented Apr 27, 2015 at 22:51
85

If you don't have or want the whole Windows SDK or Visual Studio, you can use sigcheck.exe from SysInternals:

sigcheck.exe C:\Windows\Notepad.exe

Output:

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\notepad.exe:
    Verified:       Signed
    Signing date:   8:59 AM 8/22/2013
    Publisher:      Microsoft Windows
    Description:    Notepad
    Product:        Microsoft« Windows« Operating System
    Prod version:   6.3.9600.16384
    File version:   6.3.9600.16384 (winblue_rtm.130821-1623)
    MachineType:    64-bit
9
  • 4
    Seems to be not always accurate: Try to use it with LinqPad.exe (AnyCPU-64bit version) and Sigcheck will tell you it's "32 bit" ... Commented Oct 18, 2017 at 13:55
  • @Matt interesting. LinqPad sounds like a .net app; I wonder if sigcheck only works correctly on native executables (for this purpose). Commented Oct 18, 2017 at 14:34
  • 3
    Yes, it is a .NET app. In .NET, if it isn't precompiled, you can either target "x86" or "AnyCPU". "x86" will always run as 32 bit, but AnyCPU will run as 64bit on a 64 bit system, but as 32 bit on a 32 bit system. SigCheck should consider this and show at least ".NET 32 bit or 64 bit (AnyCPU)". ILSpy for example says in this case "Architecture: AnyCPU (64-bit preferred)" - but ILSpy will not work for non-.NET EXE's. Commented Oct 18, 2017 at 14:42
  • 1
    That might be the case, like the old "MZ" header which just is there for non-Windows ("DOS") OS saying "This application requires Microsoft Windows" ... ;-) Commented Oct 18, 2017 at 14:46
  • 2
    Yeah, the good old times, where you had a DOS debugger in the shell and could disassemble the code (which just contained one single DOS call printing this message)... and replace the text by "The answer is 42." :-D Commented Oct 18, 2017 at 14:52
80

I can confirm that the file utility (e.g. from cygwin) will distinguish between 32- and 64-bit executables. They appear as follows:

32.exe: PE32 executable (GUI) Intel 80386, for MS Windows
64.exe: PE32+ executable (console) x86-64, for MS Windows

As you can see, it's very obvious which is which. Additionally it distinguishes between console and GUI executables, also obvious which is which.

6
  • 2
    This solution is pretty commonly available for any developers who have installed msysgit. Commented Feb 6, 2017 at 15:59
  • 2
    Why executable files in windows have MZ instead of PE? Commented May 15, 2018 at 13:44
  • 1
    Worth noting that GNU utilities can be obtained as individual binaries if you otherwise don't need Cygwin. gnuwin32.sourceforge.net/packages/file.htm Commented Nov 28, 2018 at 11:23
  • 2
    We can use the file command using Git Bash utility also. Which would be installed by many these days along with GIT installation Commented Jan 20, 2022 at 6:47
  • 1
    @BattleTested_закалённыйвбою it's not instead: each PE file starts with an MZ stub that usually prints "This program cannot be run in DOS mode" when run in DOS. Commented Aug 28, 2022 at 20:32
60

Many people have the excellent 7-zip installed, and have added the 7-Zip folder to their PATH. 7-zip understands file formats other than ZIP and RAR, such as MSI files and PE executables. Simply use the command line 7z.exe on the PE file (Exe or DLL) in question:

7z l some.exe | more
7z l some.exe | findstr CPU

Output will include lines as follows, with the CPU line reading either x86 or x64, which is what is being asked here:

Path = C:\Extra\AV\neroAacEnc.exe
Type = PE
CPU = x86
Characteristics = Executable 32-bit

Path = C:\Extra\AV\LAME\lame_enc.dll
Type = PE
CPU = x86
Characteristics = Executable DLL 32-bit

Path = C:\Extra\AV\FFmpeg\bin\ffmpeg.exe
Type = PE
CPU = x64
64-bit = +
Characteristics = Executable LargeAddress NoRelocs NoLineNums NoLocalSyms NoDebugInfo

Path = C:\Extra\AV\FFmpeg\bin\avcodec-56.dll
Type = PE
CPU = x64
64-bit = +
Characteristics = Executable DLL LargeAddress NoLineNums NoLocalSyms NoDebugInfo
6
  • 1
    wow I've never known that 7z can do this. Probably it contains a file implementation inside? Commented Sep 21, 2018 at 16:58
  • 1
    worked on linux!!! Commented Sep 21, 2021 at 6:22
  • Interesting - but does not always work for me: the 64bit executable from rapidee.com/en/about "cannot be opened as an archive". Commented Jul 19, 2022 at 18:24
  • While it works on “itself” (7z l 7z.exe), it doesn't work on, for example, iconv.exe as included in Strawberry Perl or Git for Windows. I checked with 7-zip 23.01 (x64). Commented Dec 7, 2023 at 9:59
  • @Wolf - Works for me on C:\Program Files\Git\usr\bin\iconv.exe using 7-Zip 22.01 ZS v1.5.5 R3 (x64) (Zstd/Brotli extended version by McMilk): Path = C:\Program Files\Git\usr\bin\iconv.exe ; Type = PE ; Physical Size = 36115 ; CPU = x64 ; … ; Checksum = 57508 … • Works identically using older 7-Zip 19.00 (x64) … 2019-02-21 on my computer (Windows 22H2 [Version 10.0.19045.3693]). Commented Dec 13, 2023 at 11:16
36

A simple method is to run it (assuming you trust it) and take a look at the process tab in task manager. 32-bit processes will show "* 32" at the end of the process name. If it's not something your willing to run on your computer you can try EXE Explorer. It will show a whole bunch of info on executables including if it's 32- or 64-bit.

6
  • 11
    Unfortunately, this requires you to run the executable. Perhaps you need to check the architecture of the program as a troubleshooting method on why it is not running. Commented Oct 2, 2012 at 16:20
  • 11
    How do you run a DLL? Commented Nov 3, 2016 at 19:57
  • 1
    @user34660 RUNDLL32.EXE <dllname>,<entrypoint> Commented Dec 14, 2017 at 18:53
  • 1
    @samusarin that should be in the post. Commented Dec 15, 2017 at 1:22
  • 1
    You can also see if a program is 64bit or 32 bit on Task Manager's Details tab, just have to enable the "Platorm" column by right clicking on one of the columns and click Select Columns Commented Nov 24, 2020 at 6:23
26

Here's a Powershell solution, no external dependencies or anything. Open Powershell, paste the function in there (hit Enter twice so that you return to the prompt), then use it as in my examples below the function:

function Test-is64Bit {
    param($FilePath=“$env:windir\notepad.exe”)

    [int32]$MACHINE_OFFSET = 4
    [int32]$PE_POINTER_OFFSET = 60

    [byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096
    $stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($FilePath, 'Open', 'Read')
    $stream.Read($data, 0, 4096) | Out-Null

    [int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET)
    [int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET)
    $stream.Close()

    $result = "" | select FilePath, FileType, Is64Bit
    $result.FilePath = $FilePath
    $result.Is64Bit = $false

    switch ($machineUint) 
    {
        0      { $result.FileType = 'Native' }
        0x014c { $result.FileType = 'x86' }
        0x0200 { $result.FileType = 'Itanium' }
        0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; }
    }

    $result
}

Here's example output:

D:\> Test-is64bit

FilePath               FileType Is64Bit
--------               -------- -------
C:\Windows\notepad.exe x64         True


D:\> Test-is64bit 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'

FilePath                                           FileType Is64Bit
--------                                           -------- -------
C:\Program Files (x86)\Mozilla Firefox\firefox.exe x86        False
5
  • Slickness. The above script seems to leave a reference to the file open. Couldn't build until I first closed powershell (ran script to interrogate DLL in \bin). Commented Oct 20, 2016 at 13:27
  • 1
    Very cool. +1. Itanium is definitely 64bit though :) Commented Jul 13, 2017 at 21:24
  • @samusarin: maybe add $stream.dispose(); after the close? Should release file handles. ( stackoverflow.com/questions/1999858/… ) Commented Dec 13, 2017 at 22:41
  • 3
    a more complete version can be found in Check if exe is 64-bit Commented Oct 16, 2018 at 16:02
  • if you're curious about the $result = "" | select FilePath, FileType, Is64Bit section, that's how you could create objects before WinPs 4 and [pscustomobject] -- meaning it's from before 2012 Commented Aug 20, 2022 at 1:32
23

The 64-bit version of Process Explorer can tell you. Simply run the executable and open the process's properties window. On the main tab there's an entry which says "Image:32 Bit" or "Image:64 Bit".

enter image description here

5
  • 35
    Simply run the executable And what if you don’t want to run the program? Commented Feb 6, 2014 at 9:23
  • 5
    @Synetech The original question doesn't imply that's the case. Commented Feb 6, 2014 at 18:13
  • This is the easiest method for me I think, unless the executable exits too fast. Commented Jan 27, 2015 at 11:00
  • 14
    How do you run a DLL? Commented Nov 3, 2016 at 19:58
  • Run it with rundll32.exe file.dll,DllEntry Commented Jul 17, 2020 at 16:23
22

Most simple way (when the data aren't confidential)

I find that Virustotal File detail is the simplest way to find out if a binary is 32 bit or 64 bit.

The Additional information option provides in addition much helpful informations about the file.

Virustotal analysis


[Virustotal TrID

0
16

The method of running an executable & then checking in process explorer or similar tool, has some obvious drawbacks:

  1. We have to execute the process.
  2. For the short lived processes (like echo hello world types.), process explorer might not even register that a new process has started.

Dumpbin.exe method can solve the purpose probably.

Another alternative would be to use cygwin's file command. However, I have not tested it on windows. It works well on Linuxes.

Usage: file program_under_test.exe

EDIT: Just tested file.exe on window. works fine. :)

13
  • 1
    Just wanted to say, that there are some situations, where Dracs's method will not be much helpful. Commented Oct 19, 2012 at 10:49
  • 3
    >>This still requires running the program which the author wanted to avoid: No.. we run it like: file.exe program_under_test.exe Commented Oct 19, 2012 at 10:49
  • 1
    And those who wish to avoid installing the whole cygwin package can grab the gnuwin32 file package. Commented Oct 19, 2012 at 11:32
  • 7
    @anishsane Completely wrong. file simply reads data from the disk in binary format and checks for any magic numbers identifying them, comparing against a database. Windows' 32-bit programs come up as PE32, and both 64-bit and .NET programs come up as PE32+. The bitness of file itself makes absolutely zero difference - both 32-bit and 64-bit applications can read data from the disk, which is all it needs. Commented Jan 17, 2014 at 2:24
  • 2
    It seems that Windows 2000 ran the stub to initiate the .NET runtime, but XP and later detects a .NET binary and runs .NET itself. It doesn't create a new process though, it starts .NET in the existing process and if it's a PE32 on a 64-bit system, it converts it in-memory to PE32+ before proceeding. social.microsoft.com/Forums/ru-RU/… Commented Dec 16, 2014 at 15:28
13

Even an executable marked as 32-bit can run as 64-bit if, for example, it's a .NET executable that can run as 32- or 64-bit. For more information see https://stackoverflow.com/questions/3782191/how-do-i-determine-if-a-net-application-is-32-or-64-bit, which has an answer that says that the CORFLAGS utility can be used to determine how a .NET application will run.

CORFLAGS.EXE output

For 32-bit executable:

Version   : v2.0.50727
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x3
ILONLY    : 1
32BITREQ  : 1
32BITPREF : 0
Signed    : 0

For 64-bit executable:

Version   : v2.0.50727
CLR Header: 2.5
PE        : PE32+
CorFlags  : 0x1
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 0

For executable that can run as 32- or 64-bit and will run as 64-bit when possible:

Version   : v2.0.50727
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x1
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 0
Signed    : 0

For executable that can run as 32- or 64-bit, but will run as 32-bit unless loaded into a 64-bit process:

Version   : v4.0.30319
CLR Header: 2.5
PE        : PE32
CorFlags  : 0x20003
ILONLY    : 1
32BITREQ  : 0
32BITPREF : 1
Signed    : 0
3
  • Cool command, but it won't work for native (non-managed) executables / dlls. (corflags : error CF008 : The specified file does not have a valid managed header) Commented Sep 15, 2016 at 8:08
  • 1
    @TomaszGandor Yes, the context of this answer was managed code only. Unmanaged code is answered by the other answers. As far as I know, only managed code can switch between executing as both 32- and 64-bit. Commented Aug 25, 2018 at 14:24
  • I personally would use other solutions, but summarizing that matter and showing all possible cases deserved an upvote. Commented Jan 28, 2021 at 22:11
12

If you are on Windows 7, on a Windows Explorer, right click on the executable and select Properties. At the properties window select the Compatibility tab. If under the Compatibility Mode section you see Windows XP, this is a 32 bit executable. If you see Windows Vista, it is 64 bit.

6
  • -1 not true at all. Various 32 and 64 bit binaries are all shown an Compatibility Mode of Windows 8 Commented Jun 16, 2015 at 12:14
  • @Peter I've tried quite a few on Windows 7 and it always worked for me. Could you give an example of a binary where the default compatibility mode is Windows 8? Also what Windows are you on? Thanks. Commented Jun 16, 2015 at 18:46
  • I'm on Server 2012 R2 and tried a few random binaries. Some 32bit ones show as Windows XP SP2 but others show as Vista or Windows 8. So this method is not correct. Commented Jun 18, 2015 at 3:27
  • 2
    @PeterHahndorf their language is a bit off but what he meant is when you open up the compatibility drop-down, if XP is an option at all it is 32bit. Otherwise if the only options you have are Vista-onwards, it's x64 Commented Oct 14, 2019 at 4:27
  • Nice trick! As stated above, open the drop-down to see all the options. If xp is there at all = 32bit Commented Jun 18, 2021 at 13:02
12

My two cents will be just download dependency walker and check what for architecture has been used in one of the executable file.

How to use it:

Just simply download app, start it up, click on open icon → find an *.exe file → select and on the bottom after reflection scan is done you see a grid with data where one column has "architecture" details in it (x86, x64)

Open executable and see the build architecture

dependency walker screenshot

9

How to add 32/64 bit test to your context menu

Create a text file named exetest.reg and containing this code:

Windows Registry Editor Version 5.00

; What will appear in the contextual menu when right-clicking on a .exe file
[HKEY_CLASSES_ROOT\exefile\shell\command32_64]
@="32/64 bit test"

; What to do with it
; here, %1 is the file given as argument of the script
[HKEY_CLASSES_ROOT\exefile\shell\command32_64\command]
@="\"c:\\temp\\x86TestStart.bat\" \"%1\""

Create a text file named x86TestStart.bat containing just this line of code and save it in C:\temp:

c:\temp\x86or64.vbs %1

Create a text file named x86or64.vbs containing this code and save it in C:\temp:

rem Reading binary file in VBScript: http://stackoverflow.com/questions/21249440/modify-first-two-bytes-of-a-file-using-vbscript
rem Info on executables: https://dmoj.ca/problem/exe

rem x86/64 signature is located dinamycally; its position is addressed
rem from bytes in 0x3C-0x3D position.

rem Possible signatures;
rem "PE..L" (hex code: 50.45.00.00.4C) = 32 bit
rem "PE..d†" (hex code: 50.45.00.00.64.86) = 64 bit

' ------------------------------------
' Source code by Jumpkack 2015
' ------------------------------------

' Read all arguments from command line:
Set args = Wscript.Arguments

' Store first argument (full path to file)
FileName = args(0)

' Find address of executable signature:
FirstChars = readBinary(FileName)
FirstChars = FirstChars
Addr1 = asc(mid(FirstChars,61,1))
Addr2 = asc(mid(FirstChars,62,1))
AddrFinal = Addr2*256 + Addr1 + 1

' Check signature:
if ucase(hex(asc(mid(FirstChars,AddrFinal+4,2)))) = "4C" then Wscript.Echo Filename & " is a 32 bit executable."
if ucase(hex(asc(mid(FirstChars,AddrFinal+4,2)))) = "64" then Wscript.Echo Filename & " is a 64 bit executable."


Function readBinary(path)
    Dim a, fso, file, i, ts
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set file = fso.getFile(path)
    If isNull(file) Then
        wscript.echo "File not found: " & path
        Exit Function
    End If
    Set ts = file.OpenAsTextStream()
    'a = makeArray(file.size)
    a=""
    i = 0
    While (Not ts.atEndOfStream) and (i<60000)
       'a(i) = ts.read(1)
       a = a + ts.read(1)
       i = i + 1
    Wend
    ts.close
    readBinary = a
 End Function

Double click on exetest.reg file: a new key will be added in the windows registry:

[HKEY_CLASSES_ROOT\exefile\shell\command32_64\command]

It will appear as "32/64 bit test" in context menu upon right clicking on an executable file.

Clicking the item will result in starting batch file c:\\temp\\x86TestStart.bat\, which starts VBscript file x86or64.vbs , which reads exe signature and shows result.

If you cannot or don't want to tamper with registry, just copy the .vbs file in QuickLaunch bar, and drag executable over it.

2
  • The line FirstChars = FirstChars is pointless and can be deleted. Not sure if that was meant to be something different? Commented Jan 29, 2021 at 7:24
  • 2
    I wanted to thank you for posting this answer. It inspired me to write a more-generic function that I posted to my GitHub repo in a file called GetExecutableProcessorArchitectureFromFile.vbs. It reads an exe's PE header, gets the machine type, and returns the processor architecture (i.e., if the executable was running and accessed the PROCESSOR_ARCHITECTURE environment variable, the contents of that variable), in string format. Commented Jan 31, 2021 at 6:43
7

Yet, WSL's file command works greatly.

file /mnt/c/p/bin/rg.exe would output:

/mnt/c/p/bin/rg.exe: PE32+ executable (console) x86-64, for MS Windows

file /mnt/c/p/bin/u.exe would output:

/mnt/c/p/bin/u.exe: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
1
  • That's nice! You could even call wsl file rg.exe from the directory where rg.exe is located. Commented Jul 19, 2022 at 18:14
6

The platform column in the task manager of windows 10

Windows 7 doesn't have a platform column. So Windows 7 task manager won't show it.

In windows 10 choosing columns is not under 'view' anymore. In Windows 10, when in the details tab, you right click column header then 'select columns'. Then check the box for 'platform'.

enter image description here

enter image description here

2
  • 1
    This requires running the application, which might be undesirable. Also, you "cannot" run a DLL. Commented Nov 12, 2019 at 9:26
  • 1
    @AndreasRejbrand fair point in a sense, though he didn't mention a dll, he just said application.. also, and the DLL will match the EXE in 'bitness' Commented Nov 12, 2019 at 19:42
6

you can also use the file tool from within the msys2 bundle of mingw-w64. It works like the unix command. Similar works the file tool from GNUwin32.

5

The Simplest Solution is that the 32-bit version has windows XP listed on the compatibility tab of the properties ( tested on Windows 7 & 10 ) of the executable file.

Firefox 32 Bit:

enter image description here

Firefox 64 Bit:

enter image description here

3

I haven't seen this mentioned. There is a PE viewer program called CFF Explorer by NTCore, which can provide you this information. It can be downloaded and run as portable, but you can install it as well, if you wish.

Right click on the binary (.exe, .dll etc.) and select "Open with CFF Explorer". Go to Nt Headers -> File Header -> On the "Characteristics" field click "Click here"

If it's a 32bit program, the checkbox "32 bit word machine" will be ticked. For instance, i have installed the 32bit version of Notepad++ as you can see in the image below. Otherwise, it's 64bit.

enter image description here

1
  • There is a quicker way with CFF explorer: immediately when loading a file, under "file type" you have "Portable Executable 64" or "Portable Executable 32" Commented Sep 5, 2019 at 11:25
2

my two cents: as a C++ developer, dependency walker (http://www.dependencywalker.com/) is very informative, not only displays 64/32 bits, but also every Dll involved: enter image description here

You can see 64 on left of every file name...

2
  • 2
    @TomEus there's "64" in the screenshot, but not in the file name but inside the file logo (on the right side) Commented Jan 18, 2020 at 2:11
  • While you can find out using Dependency Walker, it's somewhat painful, because you have to run the matching (32-bit or 64-bit) version of Dependency Walker, and if you guessed wrong, try again with the other. Commented Nov 12, 2024 at 15:39
2

My simple version in Powershell, seems to be 100% reliable from my tests.

Clear-Host
$Check32Bit = $null
$Check64Bit = $null

$File = "C:\WINDOWS\system32\notepad.exe"

$ExeData = get-content $File -totalcount 50

$Check32Bit = $ExeData | select-string -Pattern "PE..L" -Quiet
$Check64Bit = $ExeData | select-string -Pattern "PE..d†" -Quiet

if ($Check32Bit) {
"File is 32bit (x86)"
}
elseif ($Check64Bit) {
"File is 64bit (x64)"
}
else {
"Couldn't identify if the file is 32bit or 64bit"
}
1
  • Using Powershell 7.4.1, this solution does not work. Commented Feb 29, 2024 at 8:52
2

As pointed out in a comment by @user1055604, the easiest out-of-the-box way of doing this on Windows 10 is:

dumpbin /headers yourfile.lib | findstr "machine"

This one-liner will produce an intuitive result as an output. For example, on a 64-bit library I just tested, it printed the following:

8664 machine (x64)

1
  • 3
    Dumpbin is not part of a default Windows install. It comes with the Common Tools for Visual C++. See stackoverflow.com/a/38616596/102351 Commented Dec 7, 2022 at 7:13
2

You can use corflags from VS command prompt to change machine type

Change Machine Type:

corflags d:\abc.exe /32BITREQ- 

Verify using corflags:

corflags d:\abc.exe 

32BITREQ : 0 ** 0 means 64 bit

0
1

Something different from all the excellent answers above, but use PowerShell to search for the telltale "This program must be run under Win32"?

PS C:\Program Files\Snap Inc> ls -R . -filter *.exe | % { $file = $_; Select-String -Path $_ -Encoding 'oem' -Pattern 'under Win32' -SimpleMatch -Quiet } | % { Write-Output "$file is Win32: $_" }

Snap Camera.exe is Win32: False
unins000.exe is Win32: True
installer.exe is Win32: False

This also matches the results for the PE L and PE d† trick.

1

If you want to scan a folder structure for 32/64 bit DLL's or executables, you can also try a free tool called ScanFor64bit. ScanFor64bit allows you to enter a drive-letter or directory-path and one or more filemasks to scan for 32 or 64 bitness. The result is a list sorted by 32bit files first and 64bit second. I have used it a lot to check computers with Java to make sure the 64 bit version is used.

Output example of ScanFor64bit:

Output example of ScanFor64bit:

0
  • run the application
  • open Task Manager
  • right click and create dump file
  • note down path
  • go to path and open .DMP dump in Visual Studio
  • there you get all the details
  • check process architecture:
1
  • 6
    I feel obligated to underscore the fact that this answer requires running the application. Previous commenters suggested that this might be undesirable. Also, Visual Studio will not automatically be available on all Windows platforms. Commented Mar 19, 2015 at 13:46
0

I know they are many answers here, but none of them are really portable and require some kind of tool to use. I wanted to solve this in a programmatic way for all platforms. This will work on anything with a C compiler.

#include <stdio.h>
#include <fstream>      // std::fstream
#include <stdio.h>
#include <string.h>


char Header      [0x200];
char Elf32Magic  [20] = "\x7f\x45\x4c\x46\01";  //7F 45 4C 46  01 // ELF32 
char Elf64Magic  [20] = "\x7f\x45\x4c\x46\02";  //7F 45 4C 46  02 // ELF64
char Win32Magic  [20] = "\x50\x45\x00\x00\x4C\x01";// PE32
char Win64Magic  [20] = "\x50\x45\x00\x00\x64\x86";// PE64

char PeHeader[20] = {};
void CheckWinHeader(){
  int k = 0;
  for (int i = 0; i < 0x200; i++)
  {
   if(Header[i] == 0x50 && Header[i+1] == 0x45) // PE     
     {

      for(int j = i; j < i + 6; j++)
      {
        PeHeader[k] = Header[j];
        k++;
       //printf("%hhx", Header[j]); 
      }
     }
  }
}


int main(){
  std::fstream fs; 
  fs.open ("/home/PATH/TO/YOUR/BINARY", std::fstream::in | std::fstream::out | std::fstream::app);
  fs.read( Header , 0x200);
 
  if(memcmp ( Header, Elf32Magic, 5 ) == 0 ){
    printf("ELF 32 Match Found ! \n");
  }
  if(memcmp ( Header, Elf64Magic, 5 ) == 0 ){
    printf("Elf 64 Match Found ! \n");
  }

  CheckWinHeader();

  if(memcmp ( &PeHeader, Win32Magic, 6 ) == 0 ){
    printf("Win 32 Match Found ! \n");
  }

  if(memcmp ( &PeHeader, Win64Magic, 6 ) == 0 ){
    printf("Win 64 Match Found ! \n");
  }

 fs.close();
 return 0;
}

compile by using any compiler. I used g++.

g++ Bincheck.cpp -o bincheck
./bincheck
2
  • 3
    There's no C compiler by default in Windows so this isn't quite useful. If you have gcc then you'll have file command and if you have MSVC there's dumpbin available so there's no need to compiler such a program. OTOH there's notepad and powershell on Windows so you can check the binary type using either way easily without any 3rd party tools Commented Aug 11, 2020 at 14:05
  • @phuclv I think it is useful. No one asked for no 3rd part. The actual problem is the hardcoded path; it should be in the args. That's a lazy coding. Same for the code (headers..) Commented Nov 12, 2024 at 17:56
0

I wrote a utility called "Bits" which does exactly what you want. It installs an Explorer right-click menu that when selected analyses the file and tells you if it’s 32 or 64-bit.

It’s around 5.5K in size, has no dependencies beyond what is already present on the system and is a single file. The only installation required is to register a right-click menu with Explorer. The installer/uninstaller is embedded in the EXE.

Once installed you simply right-click on the file you want to check and choose, “32 or 64-bit?” from the menu.

I posted a similar answer earlier which was deleted. One comment said it was because I didn’t explain, “how use this tool to solve OPs question”, so here’s my second attempt with more details. If it’s deleted again I’ll give up.

Here’s a link to a GitHub repository where it can be download or the source code examined:

Bits utility on GitHub

0

Based on answer: How to check if a binary is 32- or 64-bit on Windows?

  • Language: VBS
  • OS: Windows XP+

Implementation: https://github.com/andry81/contools/tree/HEAD/scripts/tools/ToolAdaptors/vbs/read_pe_header_bitness.vbs

''' Read a binary file PE header bitness.

''' USAGE:
'''   read_pe_header_bitness.vbs <FilePath>

''' DESCRIPTION:
'''   <FilePath>
'''     Path to binary file to read.

' Check if a binary (EXE or DLL) is 32 bit (x86) or 64 bit (x64)

Sub PrintOrEchoLine(str)
  On Error Resume Next
  WScript.stdout.WriteLine str
  If err = &h80070006& Then
    WScript.Echo str
  End If
  On Error Goto 0
End Sub

Sub PrintOrEchoErrorLine(str)
  On Error Resume Next
  WScript.stderr.WriteLine str
  If err = &h80070006& Then
    WScript.Echo str
  End If
  On Error Goto 0
End Sub

ReDim cmd_args(WScript.Arguments.Count - 1)

Dim objShell : Set objShell = WScript.CreateObject("WScript.Shell")

Dim arg
Dim j : j = 0

For i = 0 To WScript.Arguments.Count-1 : Do ' empty `Do-Loop` to emulate `Continue`
  arg = WScript.Arguments(i)

  ' read command line flags here...

  cmd_args(j) = arg

  j = j + 1
Loop While False : Next

ReDim Preserve cmd_args(j - 1)

' MsgBox Join(cmd_args, " ")

Dim cmd_args_ubound : cmd_args_ubound = UBound(cmd_args)

If cmd_args_ubound < 0 Then
  PrintOrEchoErrorLine WScript.ScriptName & ": error: <FilePath> argument is not defined."
  WScript.Quit 1
End If

Dim FilePath : FilePath = cmd_args(0)

Dim objFS : Set objFS = CreateObject("Scripting.FileSystemObject")

Dim FilePathAbs : FilePathAbs = objFS.GetAbsolutePathName(FilePath) ' CAUTION: can alter a path character case if path exists

' remove `\\?\` prefix
If Left(FilePathAbs, 4) = "\\?\" Then
  FilePathAbs = Mid(FilePathAbs, 5)
End If

' test on path existence including long path
Dim IsFileExist : IsFileExist = objFS.FileExists("\\?\" & FilePathAbs)
If Not IsFileExist Then
  PrintOrEchoErrorLine _
    WScript.ScriptName & ": error: file does not exist:" & vbCrLf & _
    WScript.ScriptName & ": info: FilePath=`" & FilePathAbs & "`"
  WScript.Quit 2
End If

Dim FilePathToOpen

' test on long path existence
If objFS.FileExists(FilePathAbs) Then
  ' is not long path
  FilePathToOpen = FilePathAbs
Else
  ' translate into short path

  ' WORKAROUND:
  '   We use `\\?\` to bypass `GetFile` error: `File not found`.
  Dim File_ : Set File_ = objFS.GetFile("\\?\" & FilePathAbs)
  Dim FileShortPath : FileShortPath = File_.ShortPath
  If Left(FileShortPath, 4) = "\\?\" Then
    FileShortPath = Mid(FileShortPath, 5)
  End If

  FilePathToOpen = FileShortPath
End If

Dim BinaryStream : Set BinaryStream = CreateObject("ADODB.Stream")

BinaryStream.Type = 1
BinaryStream.Open

BinaryStream.LoadFromFile FilePathToOpen

Function ByteToHex(byte_)
  Dim str : str = Hex(byte_)
  If Len(str) = 1 Then
    str = "0" & str
  End If
  ByteToHex = str
End Function

Dim PeSignature : PeSignature = BinaryStream.Read(3)

Dim ByteCode
Dim PeHexStr

For i = 0 to UBound(PeSignature)
  ByteCode = Ascb(Midb(PeSignature, i + 1, 1))
  PeHexStr = PeHexStr & ByteToHex(ByteCode)
Next

rem compare on `MZђ` sequence
If PeHexStr <> "4D5A90" Then
  PrintOrEchoErrorLine _
    WScript.ScriptName & ": error: file has no PE header:" & vbCrLf & _
    WScript.ScriptName & ": info: FilePath=`" & FilePath & "`"
  WScript.Quit 3
End If

BinaryStream.Position = &H3C
Dim PositionSignature : PositionSignature = BinaryStream.Read(4)

Dim PositionHexStr

For i = 0 to UBound(PositionSignature)
    ByteCode = Ascb(Midb(PositionSignature, i + 1, 1))
    PositionHexStr = ByteToHex(ByteCode) & PositionHexStr
Next

BinaryStream.Position = CInt("&H" & PositionHexStr)

Dim BitnessSignature : BitnessSignature = BinaryStream.Read(6)

Dim BitnessHexStr

For i = 0 to UBound(BitnessSignature)
    ByteCode = Ascb(Midb(BitnessSignature, i + 1, 1))
    BitnessHexStr = BitnessHexStr & ByteToHex(ByteCode)
Next

BinaryStream.Close

If BitnessHexStr = "504500004C01" Then
  PrintOrEchoLine "32"
ElseIf BitnessHexStr = "504500006486" Then
  PrintOrEchoLine "64"
End If
2
  • That's overmouthful.. Commented Nov 12, 2024 at 14:26
  • @Soleil it does not require extra dependencies and directly extracts the PE header field Commented Nov 12, 2024 at 17:06
-1

I found the solution on the below link helpful.

https://www.appsloveworld.com/powershell/100/34/is-there-a-way-to-determine-if-an-exe-is-32-or-64-bit

$machine_offset = 4
$pe_pointer_offset = 60
$machinetype = write-output native i386 itanium x64

$filepath = "$env:windir\notepad.exe"
$data = new-object system.byte[] 4096
$stream = new-object system.io.filestream -argumentlist $filepath,open,read
$stream.read($data,0,$pe_pointer_offset) | out-null
$pe_header_addr = [system.bitconverter]::toint32($data, 
$pe_pointer_offset)
$machineuint = [system.bitconverter]::touint16($data, $pe_header_addr + 
$machine_offset)
$machinetype[$machineuint]

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.