How to Identify if the Executable is 32-bit or 64-bit

Introduction

Most of the time, we face a problem to identify whether the application or executable is compatible to 32 or 64-bit version.

Basically, there are two approaches:

1. dumpbin.exe provided with Microsoft’s Visual Studio
2. Any hex editor

Background

First Approach

Mandatorily requires, previously installed Microsoft’s Visual Studio.

Start Visual Studio command prompt (recommend Privileged Mode)

Go to:

Home > All Programs > Microsoft Visual Studio (any version probably >= 2008) > Visual Studio Tools > Visual Studio Command Prompt

Then, “Run as administrator“.

Copy dumpbin.exe into the folder where the application (EXE) is located and then run the following command:

>dumpbin.exe /headers <executable/exe/bin> | findstr "magic machine"

In case of 32bit:             machine (x86)

In case of 64bit:             machine (x64)

Second Approach

Mandatorily, any hex editor (works with notepad++.).

Note: Online hex editors can also be used.

Open the application or an EXE file with an hex editor (in my case notepad++) and locate “PE..” (Ideally found in first 256 chunk of data).

In case of 32bit:             PE..L.. (hex code: 504500004Cxxxx) = 32 bit

In case of 64bit:             PE..d.. (hex code: 504500006486xx) = 64 bit

Using the Code

Example:

D:\Software\eclipse-jee-luna-R-win32-x86_64\eclipse>dumpbin.exe /headers eclipse.exe | 
	findstr "magic machine"

            8664 machine (x64)

             20B magic # (PE32+)

D:\Software>dumpbin.exe /headers jxpiinstall.exe | findstr "magic machine"

             14C machine (x86)

                   32 bit word machine

             10B magic # (PE32)

Example:

jxpiinstall.exe

PE..L.. (hex code: 504500004Cxxxx) = 32 bit

Or

eclipse.exe

PE..d.. (hex code: 504500006486xx) = 64 bit

Points of Interest

Hex editor links:

• http://www.onlinehexeditor.com/
• https://hexed.it/?hl=en