0

This is a post following up with this one.

Similar situation as the above post - I'd like to know if there's a way to find out the architecture (x86 or x64) of a windows system from a file on a remote system. This is assuming I can only read files on a remote system and need to deduce from there. I'd like to know for as many Windows versions as possible, but my specific use case is for Windows XP.

Izy-
  • 853
  • 1
  • 8
  • 17
  • You have read access for the whole filesystem, or just part of it? – Esa Jokinen Feb 03 '19 at 11:22
  • Whole filesystem. Just had a look at your answer - how silly! The Program files folder naming didn't even strike me! Also, Eula.txt I did have a look at. It gave me the OS version + SP information at the end, but not the architecture. Will try the others, thanks! – Izy- Feb 04 '19 at 04:02

1 Answers1

1

There are several hints, but the most obvious ones would be:

  • On the current Windows versions the existence of C:\Program Files (x86)\ tells it's a 64-bit system. Any 32-bit version doesn't have it.

  • You could download C:\Windows\System32\ntoskrnl.exe. On it's version X.Y.Z the X.Y reveals the Windows (NT) version and Z the build. (5.0 for 2000, 5.1 for XP, 5.2 for 2003/XP64, 6.0 for Vista, 6.1 for 7, 6.2 for 8, 6.3 for 8.1 and 10.0 for 10).

  • Such files as System32\license.rtf, system32\eula.txt or C:\Windows\inf\layout.inf might reveal the license version (Home, Pro etc.)

Esa Jokinen
  • 16,100
  • 5
  • 50
  • 55