Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a solution to locate which process are running over 64 and which ones on 32 bits on my Windows Seven 64 system, there is a simple windows shell command available to do that???

share|improve this question
up vote 10 down vote accepted

After some thought, I realized the WMIC method is kind of hokey. A much better way to do this is to use a PowerShell script that looks something like this:

[System.Diagnostics.Process[]] $processes64bit = @()
[System.Diagnostics.Process[]] $processes32bit = @()

foreach($process in get-process) {
    $modules = $process.modules
    foreach($module in $modules) {
        $file = [System.IO.Path]::GetFileName($module.FileName).ToLower()
        if($file -eq "wow64.dll") {
            $processes32bit += $process
            break
        }
    }

    if(!($processes32bit -contains $process)) {
        $processes64bit += $process
    }
}

write-host "32-bit Processes:"
$processes32bit | sort-object Name | format-table Name, Id -auto

write-host ""
write-host "64-bit Processes:"
$processes64bit | sort-object Name | format-table Name, Id -auto

If you copy that in to a PowerShell script, call it process-width.ps1, and run it in PowerShell, it will list out all the 32-bit processes followed by the 64-bit processes.

It does this by checking if a process has wow64.dll loaded as a module in to it's process space. wow64.dll is the Windows 32-bit emulation layer for 64-bit operating systems. It will only be loaded by 32-bit processes, so checking for it is a sure-fire way to know if a process is 32-bit or not.

This should work much better as a long term solution.

share|improve this answer
    
It worked too, tyvm – Diogo May 19 '11 at 11:46
1  
A more succinct way to get all 32-bit processes: Get-Process | where { ($_.Modules | where { $_.FileName -match "\\wow64.dll$" }) } – Phil Sep 20 '12 at 14:32
wmic process get

Will list out all the processes on the system. You can pass parameters to get which are WMI Win32_Process properties. You can find that list here:

http://msdn.microsoft.com/en-us/library/aa394372(v=vs.85).aspx

One of those may show whether the process is 64 or 32-bit.

e: There isn't a direct property, but you can do:

wmic process get Name, MaximumWorkingSetSize

If the number returned by MaximumWorkingSetSize is greater than 3096, then it's definitely a 64-bit process. On my machine, 64-bit processes will have a MaximumWorkingSetSize of 32768 (aka 32gb), while 32-bit processes will have a MaximumWorkingSetSize of 1380, which is the adjusted size of my swap file. At any rate, the simple check is:

MaximumWorkingSetSize > 3096 == 64-bit
share|improve this answer
    
hmmm something is not working, i used wmic process get > file.txt and found for all entries on it, but on my 64 system it says that I have only 32 processes running. – Diogo May 18 '11 at 19:32
    
Did you run "wmic process get Name, MaximumWorkingSetSize > file.txt"? If any of those have a MaxiumumWorkingSetSize > 3096, they are 64-bit processes. Also make sure you run as an administrator account so you see all the processes not just yours. – Matt Holmes May 18 '11 at 19:35
    
Sure, i did it now and it worked, but im still getting a strange result, only dwm.exe and ccSvcHst.exe got more than 1380 score, i was thinking that most of the running process was 64 bits. – Diogo May 18 '11 at 19:38
    
However it really helped me, thank you very much Matt. – Diogo May 18 '11 at 19:39
    
Cool, nice trick. – Jeff F. May 18 '11 at 19:40

If you have Visual Studio installed, then you can simply use dumpbin.exe from the Visual Studio Command Prompt to dump the executable headers:

dumpbin.exe /HEADERS file.exe

The machine header will be 14C for an x86 binary and 8664 for x64:

x86:

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
         14C machine (x86)

x64

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
        8664 machine (x64)
share|improve this answer

It's easy, just fire Task Manager. The process with *32 is 32 bit app

enter image description here

share|improve this answer
    
I think he very clearly wanted this as a shell script, or something he could run and parse the output of. – Matt Holmes May 18 '11 at 23:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .