Solved

Identify .Exe is 32 bit or 64 bit

Posted on 2006-06-14
8
631 Views
Last Modified: 2013-11-20
Hi,
     
      Any API or function which would say that a .exe file is either 64bit or 32 bit.
      I don't want to load the .exe in to the memory and then find out 32 or 64 bit.

Thanks in Advance,
Ramesh.
0
Comment
Question by:ramesh_hyd_ap
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
8 Comments
 
LVL 11

Accepted Solution

by:
DeepuAbrahamK earned 25 total points
ID: 16909708
I don't know any API but this might work:

1.Open .exe file in using fopen
2.Search for string "This program must be run under Win32" or "Win32"./Search for string "This program must be run under Win64 or "Win64".
3.Close file.

Best Regards,
DeepuAbrahamK
0
 
LVL 1

Author Comment

by:ramesh_hyd_ap
ID: 16911268
Hi,
     I think there should be a more better approach because if in the future if Microsoft changes these strings, my validation will fail.

Thanks,
Ramesh.
0
 
LVL 2

Expert Comment

by:karfi
ID: 16944384
maybe this works:

check "magic" field in the PE header, and if its value is 0x020b, the file is a 64bit executable.
0
 
LVL 1

Author Comment

by:ramesh_hyd_ap
ID: 16948795
Hi karfi,
 
I don't much about PE header, can u please be more detail.

Thanks,
Ramesh.
0
 
LVL 2

Assisted Solution

by:karfi
karfi earned 25 total points
ID: 16948967
Hi!

you can read more here (for example):

http://en.wikibooks.org/wiki/Reverse_Engineering/PE#MS-DOS_header

some explanation for the page:

The offset of the PE exe header is in the DOS header in the beginning of the .exe file.
(e_lfanew in the DOS_Header structure, 0x00000080 is tipical, sometimes it is 0x000000e0 but can be any value (maybe aligned to 4 or 16? bytes)).

After you get PE offset (from the beginning of the file), you can read a COFF header(you can skip this) and a PE Optional header.

The field "magic" I mentioned is called "signature" on the wiki page. (It is the first member of the PEOptHeader struct)

BR,
mate
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction: Dynamic window placements and drawing on a form, simple usage of windows registry as a storage place for information. Continuing from the first article about sudoku.  There we have designed the application and put a lot of user int…
In this post we will learn different types of Android Layout and some basics of an Android App.
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question