[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Identify .Exe is 32 bit or 64 bit

Posted on 2006-06-14
8
Medium Priority
?
640 Views
Last Modified: 2013-11-20
Hi,
     
      Any API or function which would say that a .exe file is either 64bit or 32 bit.
      I don't want to load the .exe in to the memory and then find out 32 or 64 bit.

Thanks in Advance,
Ramesh.
0
Comment
Question by:ramesh_hyd_ap
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
8 Comments
 
LVL 11

Accepted Solution

by:
Deepu Abraham earned 100 total points
ID: 16909708
I don't know any API but this might work:

1.Open .exe file in using fopen
2.Search for string "This program must be run under Win32" or "Win32"./Search for string "This program must be run under Win64 or "Win64".
3.Close file.

Best Regards,
DeepuAbrahamK
0
 
LVL 1

Author Comment

by:ramesh_hyd_ap
ID: 16911268
Hi,
     I think there should be a more better approach because if in the future if Microsoft changes these strings, my validation will fail.

Thanks,
Ramesh.
0
 
LVL 2

Expert Comment

by:karfi
ID: 16944384
maybe this works:

check "magic" field in the PE header, and if its value is 0x020b, the file is a 64bit executable.
0
 
LVL 1

Author Comment

by:ramesh_hyd_ap
ID: 16948795
Hi karfi,
 
I don't much about PE header, can u please be more detail.

Thanks,
Ramesh.
0
 
LVL 2

Assisted Solution

by:karfi
karfi earned 100 total points
ID: 16948967
Hi!

you can read more here (for example):

http://en.wikibooks.org/wiki/Reverse_Engineering/PE#MS-DOS_header

some explanation for the page:

The offset of the PE exe header is in the DOS header in the beginning of the .exe file.
(e_lfanew in the DOS_Header structure, 0x00000080 is tipical, sometimes it is 0x000000e0 but can be any value (maybe aligned to 4 or 16? bytes)).

After you get PE offset (from the beginning of the file), you can read a COFF header(you can skip this) and a PE Optional header.

The field "magic" I mentioned is called "signature" on the wiki page. (It is the first member of the PEOptHeader struct)

BR,
mate
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is to be the first in a series of articles demonstrating the development of a complete windows based application using the MFC classes.  I’ll try to keep each article focused on one (or a couple) of the tasks that one may meet.   Introductio…
Introduction: Hints for the grid button.  Nested classes, templated collections.  Squash that darned bug! Continuing from the sixth article about sudoku.   Open the project in visual studio. First we will finish with the SUD_SETVALUE messa…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question