How to find my Windows OS is x64 or ia64?

Question

Let me explain the scenario.

While I scan many executables in my windows director with ProtectionID, I had to scan Windows Explorer. And the results or given below.

Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.548 Second(s)

I know that my processor is Core 2 Duo and it's x64 architecture as resulted in warning flag. But the OS I've installed in Windows 7 x64 arch. The above results raise me a question that my OS is x64 or IA64? How can I find that?

Answer 1

The CPU type should be in the environment variable %PROCESSOR_ARCHITECTURE%, and echo %PROCESSOR_ARCHITECTURE% in the command prompt should give you AMD64 on a x86-64 processor. msinfo32.exe should also have a "System Type" field, which says x64-based PC for me on a x86-64 processor. I'm not sure how/why you have a IA64 system binary...

---

It seems to be a problem with ProtectionID:

Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.828 Second(s)

But in the PE Stuff tab:

^{Click for full size}

Answer 2

As the first comment on the Q notes, there is no IA64 build of Windows 7. For an IA64 version you must use server.

Perhaps the most reliable way to determine this information is with WMI and the classes Win32_OperatingSystem and Win32_ComputerSystem.

Using PowerShell and the gwmi alias for Get-WmiObject:

PS> gwmi win32_computersystem -computer one,two,localhost| ft __SERVER,systemtype

__SERVER                                          systemtype
--------                                          ----------
ONE                                               X86-based PC
TWO                                               x64-based PC
THREE                                             x64-based PC

so One isn't 64bit, and the other two are both x64, none are IA64.¹ Then:

PS [64] E:\ #12> gwmi win32_operatingsystem -comp one,two,localhost| ft __SERVER,caption

__SERVER                                          caption
--------                                          -------
ONE                                               Microsoft® Windows Server® 2008 Standard
TWO                                               Microsoft Windows Server 2008 R2 Standard
THREE                                             Microsoft Windows 7 Ultimate

So One is Win2k8 32bit, Two is Win2k8R2 64bit and Three (localhost) is Win7 64bit.

---

¹ I don't have an IA64 system to check what value the SystemType field will have.

Answer 3

The IA64 architecture is completely different from the x86-64 (aka AMD64) architecture, which is what most people mean when they say 64-bit. So even if there was a IA64-compatible version of Windows 7 (which, as other people have pointed out, there isn't¹), it would require an Itanium processor, you wouldn't be able to install it on a Core 2 Duo or any other x86-64 system.

Edit: also, an alternative way to get the processor architecture with WMI (from command prompt or PS):

wmic CPU get Architecture

CPU is an alias for the Win32_Processor class, and the possible values² are (meanings in parentheses):

• 0 (x86)
• 9 (x86-64)
• 6 (Itanium)

¹ The last client version to support IA64 was Windows XP; Windows Server 2008 R2 will be the last server version.
² There's a few others, for architectures like MIPS, Alpha and PowerPC, but those are mostly there for legacy reasons; see the MSDN article above for full details.

Answer 4

Open a Command window and run the following:

C:\>set | findstr ARCH

PROCESSOR_ARCHITECTURE=x86