Is there a windows command that returns the list of 64 and 32 process?

Question

I am looking for a solution to locate which process are running over 64 and which ones on 32 bits on my Windows Seven 64 system, there is a simple windows shell command available to do that???

Answer 1

After some thought, I realized the WMIC method is kind of hokey. A much better way to do this is to use a PowerShell script that looks something like this:

[System.Diagnostics.Process[]] $processes64bit = @()
[System.Diagnostics.Process[]] $processes32bit = @()

foreach($process in get-process) {
    $modules = $process.modules
    foreach($module in $modules) {
        $file = [System.IO.Path]::GetFileName($module.FileName).ToLower()
        if($file -eq "wow64.dll") {
            $processes32bit += $process
            break
        }
    }

    if(!($processes32bit -contains $process)) {
        $processes64bit += $process
    }
}

write-host "32-bit Processes:"
$processes32bit | sort-object Name | format-table Name, Id -auto

write-host ""
write-host "64-bit Processes:"
$processes64bit | sort-object Name | format-table Name, Id -auto

If you copy that in to a PowerShell script, call it process-width.ps1, and run it in PowerShell, it will list out all the 32-bit processes followed by the 64-bit processes.

It does this by checking if a process has wow64.dll loaded as a module in to it's process space. wow64.dll is the Windows 32-bit emulation layer for 64-bit operating systems. It will only be loaded by 32-bit processes, so checking for it is a sure-fire way to know if a process is 32-bit or not.

This should work much better as a long term solution.

Answer 2

wmic process get

Will list out all the processes on the system. You can pass parameters to get which are WMI Win32_Process properties. You can find that list here:

http://msdn.microsoft.com/en-us/library/aa394372(v=vs.85).aspx

One of those may show whether the process is 64 or 32-bit.

e: There isn't a direct property, but you can do:

wmic process get Name, MaximumWorkingSetSize

If the number returned by MaximumWorkingSetSize is greater than 3096, then it's definitely a 64-bit process. On my machine, 64-bit processes will have a MaximumWorkingSetSize of 32768 (aka 32gb), while 32-bit processes will have a MaximumWorkingSetSize of 1380, which is the adjusted size of my swap file. At any rate, the simple check is:

MaximumWorkingSetSize > 3096 == 64-bit

Answer 3

If you have Visual Studio installed, then you can simply use dumpbin.exe from the Visual Studio Command Prompt to dump the executable headers:

dumpbin.exe /HEADERS file.exe

The machine header will be 14C for an x86 binary and 8664 for x64:

x86:

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
         14C machine (x86)

x64

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
        8664 machine (x64)

Answer 4

It's easy, just fire Task Manager. The process with *32 is 32 bit app