Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let me explain the scenario.

While I scan many executables in my windows director with ProtectionID, I had to scan Windows Explorer. And the results or given below.

Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.548 Second(s)

I know that my processor is Core 2 Duo and it's x64 architecture as resulted in warning flag. But the OS I've installed in Windows 7 x64 arch. The above results raise me a question that my OS is x64 or IA64? How can I find that?

share|improve this question
2  
As far as I can see only the Server editions of Windows have an explicit version for the Itanium architecture (aka IA64), with Win7 64-bit just supporting the "usual" x64 instruction set. Are you 100% sure you've installed the 64-bit version of Windows 7? And are you 100% sure your CPU is defintely 64-bit (I've not checked if all Core 2 Duos were). Oh, and does the exe work (I'm assuming so else you'd have serious OS trouble)? If so, I'd be dubious that the software is given a valid reading, check with something else. –  DMA57361 May 16 '12 at 7:45
    
The CPU type should be in the environment variable %PROCESSOR_ARCHITECTURE%, and echo %PROCESSOR_ARCHITECTURE% in the command prompt should give you AMD64 (as you say you're using a Core 2 Duo). msinfo32.exe should also have a "System Type" field, which says x64-based PC for me on a x86-64 processor. I'm not sure how/why you have a IA64 system binary... –  Bob May 16 '12 at 7:51
5  
That, or ProtectionID is broken. –  user3463 May 16 '12 at 7:52
    
What version of ProtectionID? –  David Schwartz May 16 '12 at 7:54
    
@DMA57361 - I've Core 2 Duo E7300. I've Windows 7 x64 Ultimate. As per my taskmgr, around 40% of my processes running in x86 compatibility mode i.e., with a *32 suffix after the image name. –  Jones May 16 '12 at 18:02
show 2 more comments

4 Answers

up vote 7 down vote accepted

The CPU type should be in the environment variable %PROCESSOR_ARCHITECTURE%, and echo %PROCESSOR_ARCHITECTURE% in the command prompt should give you AMD64 on a x86-64 processor. msinfo32.exe should also have a "System Type" field, which says x64-based PC for me on a x86-64 processor. I'm not sure how/why you have a IA64 system binary...


It seems to be a problem with ProtectionID:

Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.828 Second(s)

But in the PE Stuff tab:

Screenshot (IMAGE_FILE_MACHINE_AMD64
Click for full size

share|improve this answer
    
Sailing in the same boat! Additionally the Misc Tools ->Misc Tools/System info -> Processor architecture says 'Intel(x86) based' –  Jones May 16 '12 at 18:11
add comment

As the first comment on the Q notes, there is no IA64 build of Windows 7. For an IA64 version you must use server.

Perhaps the most reliable way to determine this information is with WMI and the classes Win32_OperatingSystem and Win32_ComputerSystem.

Using PowerShell and the gwmi alias for Get-WmiObject:

PS> gwmi win32_computersystem -computer one,two,localhost| ft __SERVER,systemtype

__SERVER                                          systemtype
--------                                          ----------
ONE                                               X86-based PC
TWO                                               x64-based PC
THREE                                             x64-based PC

so One isn't 64bit, and the other two are both x64, none are IA64.1 Then:

PS [64] E:\ #12> gwmi win32_operatingsystem -comp one,two,localhost| ft __SERVER,caption

__SERVER                                          caption
--------                                          -------
ONE                                               Microsoft® Windows Server® 2008 Standard
TWO                                               Microsoft Windows Server 2008 R2 Standard
THREE                                             Microsoft Windows 7 Ultimate

So One is Win2k8 32bit, Two is Win2k8R2 64bit and Three (localhost) is Win7 64bit.


1 I don't have an IA64 system to check what value the SystemType field will have.

share|improve this answer
add comment

The IA64 architecture is completely different from the x86-64 (aka AMD64) architecture, which is what most people mean when they say 64-bit. So even if there was a IA64-compatible version of Windows 7 (which, as other people have pointed out, there isn't1), it would require an Itanium processor, you wouldn't be able to install it on a Core 2 Duo or any other x86-64 system.

Edit: also, an alternative way to get the processor architecture with WMI (from command prompt or PS):

wmic CPU get Architecture

CPU is an alias for the Win32_Processor class, and the possible values2 are (meanings in parentheses):

  • 0 (x86)
  • 9 (x86-64)
  • 6 (Itanium)

1 The last client version to support IA64 was Windows XP; Windows Server 2008 R2 will be the last server version.
2 There's a few others, for architectures like MIPS, Alpha and PowerPC, but those are mostly there for legacy reasons; see the MSDN article above for full details.

share|improve this answer
    
Got 9. Thanks for the code. –  Jones May 16 '12 at 17:56
    
@William.Ebe A standard x86-64 CPU, as expected. The problem likely lies with ProtectionID, then. Glad I could help. Please remember to accept the answer that helped you most by clicking the green checkmark outline next to it. –  Indrek May 16 '12 at 18:29
add comment

Open a Command window and run the following:

C:\>set | findstr ARCH

PROCESSOR_ARCHITECTURE=x86
share|improve this answer
    
Listing all variables then filtering out one is not efficient when you already know the name. Simply use the environment variable directly, as I described on my answer. –  Bob Feb 16 '13 at 19:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.