Is there an easy way to check if a binary is 32 or 64 bit on Windows? I need to check before I move the program to a 32bit machine and experience a spectacular failure.
SeptagramSeptagram
19 Answers
After examining header values from Richard's answer, I came up with a solution which is fast, easy, and only requires a text editor. Even Windows' default notepad.exe would work.
An Incomplete List of Executable File Extensions. A file with an executable file extension means that the file format supports some ability to run an automatic task. This is in contrast to other file formats that just display data, play a sound or video, etc. In other words, if you open a file with one of these file extensions. Portable Executable (PE, PE/COFF, PE32, PE32+) is a member of the EXE family of executable file formats. It is used by the Microsoft Windows family of operating systems (starting with Windows 95 and Win32s), EFI and sometimes in other environments. It is an extension/hybrid of MS-DOS EXE, and a successor to NE. Parts of it are derived from COFF.
- Open the executable in text editor. You might have to drag-and-drop or usethe editor's
Open...
dialog, because Windows doesn't showOpen with...
option in context menu for executables. - Check the first printable characters after the first occurrence of
PE
. This part is most likely to be surrounded by at least some whitespace (could be a lot of it), so it can be easily done visually.
Here is what you're going to find:
x86:
x64:
A word of warning: using default Notepad on big files can be very slow, so better not use it for files larger than a megabyte or few. In my case in took about 30 seconds to display a 12 MiB file. Notepad++, however, was able to display a 120 MiB executable almost instantly.
This is solution might be useful in case you need to inspect a file on a machine you can't install any additional software on.
If you have a HEX-Editor available, the offset of PE Signature is located at offset
0x3C
. The signature is PE00
(letters 'P' and 'E' followed by two null bytes), followed by a two byte Machine Type in Little Endian.The relevant values are
0x8664
for x64 executable and 0x14c
for x86. There are a lot more possible values, but you probably won't ever encounter any of these, or be able to run such executables on your Windows PC.Full list of machine types, along with the rest of .exe specifications can be found in Microsoft PE and COFF SpecificationMachine Types section.
Alexander RevoAlexander Revo
The SDK tool
dumpbin.exe
with the /headers
option includes this information, compare these two (I've added bold for the key information)and
RichardRichard
If you don't have or want the whole Windows SDK or Visual Studio, you can use
sigcheck.exe
from SysInternals:Output:
briantistbriantist
I can confirm that the
file
utility (e.g. from cygwin) will distinguish between 32- and 64-bit executables. They appear as follows:As you can see, it's very obvious which is which. Additionally it distinguishes between console and GUI executables, also obvious which is which.
wmassinghamwmassingham
A simple method is to run it (assuming you trust it) and take a look at the process tab in task manager. 32bit processes will show '* 32' at the end of the process name. If it's not something your willing to run on your computer you can try EXE Explorer. It will show a whole bunch of info on executables including if it's 32 or 64bit.
DracsDracs
Many people have the excellent 7-zip installed, and have added the 7-Zip folder to their
PATH
. 7-zip understands file formats other than ZIP and RAR, such as MSI files and PE executables. Simply use the command line 7z.exe
on the PE file (Exe or DLL) in question:Output will include lines as follows, with the
CPU
line reading either x86
or x64
, which is what is being asked here:LumiLumi
The 64-bit version of Process Explorer can tell you. Simply run the executable and open the process's properties window. On the main tab there's an entry which says 'Image:32 Bit' or 'Image:64 Bit'.
Andrew LambertAndrew Lambert
Most simple way (when the data aren't confidential)
I find that Virustotal
File detail
is the simplest way to find out if a binary is 32 bit or 64 bit.The
Additional information
option provides in addition much helpful informations about the file.marsh-wigglemarsh-wiggle
The method of running an executable & then checking in process explorer or similar tool, has some obvious drawbacks:
- We have to execute the process.
- For the short lived processes (like echo hello world types.), process explorer might not even register that a new process has started.
Dumpbin.exe method can solve the purpose probably.
Another alternative would be to use cygwin's file command. However, I have not tested it on windows. It works well on Linuxes.
EDIT: Just tested file.exe on window. works fine. :)
anishsaneanishsane
Here's a Powershell solution, no external dependencies or anything. Open Powershell, paste the function in there (hit Enter twice so that you return to the prompt), then use it as in my examples below the function:
Here's example output:
megamorfmegamorf
Even an executable marked as 32-bit can run as 64-bit if, for example, it's a .NET executable that can run as 32- or 64-bit. For more information see https://stackoverflow.com/questions/3782191/how-do-i-determine-if-a-net-application-is-32-or-64-bit, which has an answer that says that the CORFLAGS utility can be used to determine how a .NET application will run.
CORFLAGS.EXE output
For 32-bit executable:
For 64-bit executable:
For executable that can run as 32- or 64-bit and will run as 64-bit when possible:
For executable that can run as 32- or 64-bit, but will run as 32-bit unless loaded into a 64-bit process:
Community♦
BlueMonkMNBlueMonkMN
you can also use the
file
tool from within the msys bundle of mingw. It works like the unix command. Similar works the file
tool from GNUwin32.Bastian EbelingBastian Ebeling
If you are on Windows 7, on a Windows Explorer, right click on the executable and select Properties.At the properties window select the Compatibility tab.If under the Compatibility Mode section you see Windows XP, this is a 32 bit executable.If you see Windows Vista, it is 64 bit.
axxisaxxis
Create a text file named exetest.reg and containing this code:
Create a text file named
x86TestStart.bat
containing just this line of code and save it in C:temp:Create a text file named
x86or64.vbs
containing this code and save it in C:temp:Double click on exetest.reg file: a new key will be added in the windows registry:
It will appear as '32/64 bit test' in context menu upon right clicking on an executable file.
Clicking the item will result in starting batch file
c:tempx86TestStart.bat
, which starts VBscript file x86or64.vbs
, which reads exe signature and shows result.If you cannot or don't want to tamper with registry, just copy the .vbs file in QuickLaunch bar, and drag executable over it.
jumpjackjumpjack
My two cents will be just download dependency walker and check what for architecture has been used in one of the executable file.
Just simply download app, start it up, click on open icon → find an *.exe file → select and on the bottom after reflection scan is done you see a grid with data where one column has 'architecture' details in it (x86, x64)
Open executable and see the build architecture
stenlystenly
- run the application
- open Task Manager
- right click and create dump file
- note down path
- go to path and open
.DMP
dump in Visual Studio - there you get all the details
- check process architecture:
user429538user429538
I haven't seen this mentioned. There is a PE viewer program called CFF Explorer by NTCore, which can provide you this information. It can be downloaded and run as portable, but you can install it as well, if you wish.
Right click on the binary (
.exe
, .dll
etc.) and select 'Open with CFF Explorer'. Go to Nt Headers -> File Header -> On the 'Characteristics' field click 'Click here'If it's a 32bit program, the checkbox '32 bit word machine' will be ticked. For instance, i have installed the 32bit version of Notepad++ as you can see in the image below. Otherwise, it's 64bit.
NikosNikos
my two cents:as a C++ developer, dependency walker (http://www.dependencywalker.com/) is very informative, not only displays 64/32 bits, but also every Dll involved:
You can see 64 on left of every file name...
ingcontiingconti
Yet, WSL's
file
command works greatly.file /mnt/c/p/bin/rg.exe
would output:file /mnt/c/p/bin/u.exe
would output:BohrBohr