- Open windows binary file in any text/hex editor (notepad is enough)
- Find first occurrence of "PE" string (it will be probably placed at offset 0xD0, 0xF0 or something like that after phrase "This program cannot be run in DOS mode")
- Skip 2 non-printable symbols (both '\0')
- Look on the symbol you are at:
- 'L' - i386 binary (x86)
- 'd' - amd64 binary (x64/x86-64)
- '\0' (zero) - ia64 binary
Oct 5, 2009
Whether this windows binary is 32- or 64-bit?
The fastest way to answer on this question without using special software tools is:
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment