Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So, I need to do just that before I move the program to 32bit machine and experience a spectacular failure. Is there an easy way to do this?

share|improve this question
    
possible duplicate of Is there a windows command that returns the list of 64 and 32 process? –  Diogo Nov 17 '11 at 10:55
13  
Not a duplicate: an exe is not yet a process. –  Richard Nov 17 '11 at 12:10
    
This question is similar, however it requires some work to check it. –  ST3 Aug 8 '14 at 11:42

12 Answers 12

up vote 11 down vote accepted

After examining header values from Richard's answer, I came up with a solution which is fast, easy, and only requires a text editor. Even Windows' default notepad.exe would work.

  1. Open the executable in text editor. You might have to drag-and-drop or use the editor's Open... dialog, because Windows doesn't show Open with... option in context menu for executables.

  2. Check the first printable characters after the first occurrence of PE. This part is most likely to be surrounded by at least some whitespace (could be a lot of it), so it can be easily done visually.

Here is what you're going to find:

x86:

PE  L

x64:

PE  d†

A word of warning: using default Notepad on big files can be very slow, so better not use it for files larger than a megabyte or few. In my case in took about 30 seconds to display a 12 MiB file. Notepad++, however, was able to display a 120 MiB executable almost instantly.

This is solution might be useful in case you need to inspect a file on a machine you can't install any additional software on.

share|improve this answer
4  
Hey, this is rather hacky. And for the better, since this actually appears to be the fastest and easiest solution for the vast majority of cases :) –  Septagram Mar 13 at 21:51

The SDK tool dumpbin.exe with the /headers option includes this information, compare these two (I've added bold for the key information)

PS [64] E:\ #4> dumpbin /headers C:\Windows\system32\cmd.exe
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\system32\cmd.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
            8664 machine (x64)
               6 number of sections
        4CE798E5 time date stamp Sat Nov 20 09:46:13 2010
               0 file pointer to symbol table
               0 number of symbols
              F0 size of optional header
              22 characteristics
                   Executable
                   Application can handle large (>2GB) addresses
[...]

and

PS [64] E:\ #5> dumpbin /headers C:\Windows\syswow64\cmd.exe
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\syswow64\cmd.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4CE78E2B time date stamp Sat Nov 20 09:00:27 2010
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine
[...]
share|improve this answer
1  
You could also see (IA64) for a 64bit Itanium exe. –  Darryl Braaten Nov 17 '11 at 17:01
6  
as i read elsewhere on superuser, using dumpbin /headers | findstr "machine" greatly simplifies the presentation of what the QA is looking for... –  user1055604 Mar 17 '13 at 14:10
1  
Dumpbin.exe is located here: C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\bin –  Devid Jul 30 '14 at 11:12
    
@David: not necessarily (different version of VS, not using the default install location, using version from the Windows SDK): that is why I didn't specify. –  Richard Jul 30 '14 at 11:17
    
It's easiest to use dumpbin if you launch it from the visual studio command-line: stackoverflow.com/a/477389/1390430 –  Ben Apr 27 at 22:51

A simple method is to run it (assuming you trust it) and take a look at the process tab in task manager. 32bit processes will show "* 32" at the end of the process name. If it's not something your willing to run on your computer you can try EXE Explorer. It will show a whole bunch of info on executables including if it's 32 or 64bit.

share|improve this answer
2  
Unfortunately, this requires you to run the executable. Perhaps you need to check the architecture of the program as a troubleshooting method on why it is not running. –  Mike Christiansen Oct 2 '12 at 16:20

The 64-bit version of Process Explorer can tell you. Simply run the executable and open the process's properties window. On the main tab there's an entry which says "Image:32 Bit" or "Image:64 Bit".

enter image description here

share|improve this answer
8  
Simply run the executable And what if you don’t want to run the program? –  Synetech Feb 6 '14 at 9:23
1  
@Synetech The original question doesn't imply that's the case. –  Andrew Lambert Feb 6 '14 at 18:13
    
This is the easiest method for me I think, unless the executable exits too fast. –  starbeamrainbowlabs Jan 27 at 11:00

The method of running an executable & then checking in process explorer or similar tool, has some obvious drawbacks:

  1. We have to execute the process.
  2. For the short lived processes (like echo hello world types.), process explorer might not even register that a new process has started.

Dumpbin.exe method can solve the purpose probably.

Another alternative would be to use cygwin's file command. However, I have not tested it on windows. It works well on Linuxes.

Usage: file program_under_test.exe

EDIT: Just tested file.exe on window. works fine. :)

share|improve this answer
    
This adds nothing that wasn't said by Dracs or Richard. This still requires running the program which the author wanted to avoid. –  Ramhound Oct 19 '12 at 10:45
1  
Just wanted to say, that there are some situations, where Dracs's method will not be much helpful. –  anishsane Oct 19 '12 at 10:49
1  
>>This still requires running the program which the author wanted to avoid: No.. we run it like: file.exe program_under_test.exe –  anishsane Oct 19 '12 at 10:49
1  
And those who wish to avoid installing the whole cygwin package can grab the gnuwin32 file package. –  Bob Oct 19 '12 at 11:32
3  
@anishsane Completely wrong. file simply reads data from the disk in binary format and checks for any magic numbers identifying them, comparing against a database. Windows' 32-bit programs come up as PE32, and both 64-bit and .NET programs come up as PE32+. The bitness of file itself makes absolutely zero difference - both 32-bit and 64-bit applications can read data from the disk, which is all it needs. –  Bob Jan 17 '14 at 2:24

I'm too new of a user to add a comment to anishsane's answer, but I can confirm that the file utility (e.g. from cygwin) does in fact distinguish between 32- and 64-bit executables. They appear as follows:

32.exe: PE32 executable (GUI) Intel 80386, for MS Windows
64.exe: PE32+ executable (console) x86-64, for MS Windows

As you can see, it's very obvious which is which. Additionally it distinguishes between console and GUI executables, also obvious which is which.

share|improve this answer

If you don't have or want the whole Windows SDK or Visual Studio, you can use sigcheck.exe from SysInternals:

sigcheck.exe C:\Windows\Notepad.exe

Output:

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\notepad.exe:
    Verified:       Signed
    Signing date:   8:59 AM 8/22/2013
    Publisher:      Microsoft Windows
    Description:    Notepad
    Product:        Microsoft« Windows« Operating System
    Prod version:   6.3.9600.16384
    File version:   6.3.9600.16384 (winblue_rtm.130821-1623)
    MachineType:    64-bit
share|improve this answer

Virustotal

I find that Virustotal File detail is the simplest way to find out if a binary is 32 bit or 64 bit.

The Additional information option provides in addition much helpful informations about the file.

Virustotal analysis


[Virustotal TrID

share|improve this answer

you can also use the file tool from within the msys bundle of mingw. It works like the unix command. Similar works the file tool from GNUwin32.

share|improve this answer

Here's a Powershell solution, no external dependencies or anything. Open Powershell, paste the function in there (hit Enter twice so that you return to the prompt), then use it as in my examples below the function:

function Test-is64Bit {
    param($FilePath=“$env:windir\notepad.exe”)

    [int32]$MACHINE_OFFSET = 4
    [int32]$PE_POINTER_OFFSET = 60

    [byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096
    $stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($FilePath, ‘Open’, ‘Read’)
    $stream.Read($data, 0, 4096) | Out-Null

    [int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET)
    [int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET)

    $result = "" | select FilePath, FileType, Is64Bit
    $result.FilePath = $FilePath
    $result.Is64Bit = $false

    switch ($machineUint) 
    {
        0      { $result.FileType = ‘Native’ }
        0x014c { $result.FileType = 'x86' }
        0x0200 { $result.FileType = 'Itanium' }
        0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; }
    }

    $result
}

Here's example output:

D:\> Test-is64bit

FilePath               FileType Is64Bit
--------               -------- -------
C:\Windows\notepad.exe x64         True


D:\> Test-is64bit 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'

FilePath                                           FileType Is64Bit
--------                                           -------- -------
C:\Program Files (x86)\Mozilla Firefox\firefox.exe x86        False
share|improve this answer
  • run the application
  • open Task Manager
  • right click and create dump file
  • note down path
  • go to path and open .DMP dump in Visual Studio
  • there you get all the details
  • check process architecture:
share|improve this answer
    
I feel obligated to underscore the fact that this answer requires running the application. Previous commenters suggested that this might be undesirable. Also, Visual Studio will not automatically be available on all Windows platforms. –  G-Man Mar 19 at 13:46

On a Windows Explorer, right click on the executable and select Properties. At the properties window select the Compatibility tab. If under the Compatibility Mode section you see Windows XP, this is a 32 bit executable. If you see Windows Vista, it is 64 bit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.