Oct 5, 2009

Whether this windows binary is 32- or 64-bit?

The fastest way to answer on this question without using special software tools is:
  1. Open windows binary file in any text/hex editor (notepad is enough)
  2. Find first occurrence of "PE" string (it will be probably placed at offset 0xD0, 0xF0 or something like that after phrase "This program cannot be run in DOS mode")
  3. Skip 2 non-printable symbols (both '\0')
  4. Look on the symbol you are at:
    • 'L' - i386 binary (x86)
    • 'd' - amd64 binary (x64/x86-64)
    • '\0' (zero) - ia64 binary
p.s. You can use that method for any PE binary (like .exe, .dll and others)

No comments:

Post a Comment