windowscpu-architectureportable-executableidentification

How do I determine the architecture of an executable binary on Windows 10


Given some Random.exe on Windows, how can I determine

  1. its CPU architecture eg Intel/ARM, and
  2. its bitness eg 32 or 64.

Is there a property in File Explorer, some other tool, or programatic method I can use?


Solution

  • The architecture of the executable is written in the Machine field of the COFF header. You can retrieve it programatically or manually with a hex editor:

    You can see PE structure here. The valid Machine field values are listed here.

    EDIT: Here's a C code that does that, untested:

    int main(int argc, char *argv[]) {
        FILE *f = fopen(argv[1], "rb");
        uint32_t offset = 0;
        fseek(f, 0x3c, SEEK_SET);
        fread(&offset, sizeof(offset), 1, f);
        fseek(f, offset + 4, SEEK_SET);
        uint16_t machine = 0;
        fread(&machine, sizeof(machine), 1, f);
        printf("Machine: 0x%.4x\n", machine);
    }