Quick way to tell if an installed application is 64-bit or 32-bit

106

30

I've got a third-party application (in this case Cognos Data Manager) installed on 64-bit Windows Server 2003.

Is there a quick way to determine if an application has been built/compiled as a 64-bit application or as a 32-bit application?

By default a program wanted to be installed in Program Files (x86). I'm guessing that means that it is a 32-bit version. I had to get it to talk to an Oracle database and to get that working I eventually reinstalled it in a directory path which didn't have brackets "(" and ")" in it, as that was causing a problem. I've also installed both 64-bit and 32-bit Oracle clients.

For future reference, I'd like to be able to type a command "xxxx fred.exe" and have it tell me whether fred.exe would be needing 32-bit or 64-bit setup (eg ODBC data sources etc).

Gary

Posted 2010-01-31T21:34:22.430

Reputation: 1 300

1If an app lies in Progam Files (x86) folder it by no means ensures the app is 64 bit compiled. It's just a convention most installers follow. For e.g. Chrome 64 bit gets installed to x86 folder (sadly). – nawfal – 2016-06-29T07:18:21.630

Answers

91

If you run the application, in Task Manager it should have a *32 beside it to indicate it's 32-bit. I'm pretty sure they had this implemented in Server 2003, not positive though, hopefully someone can clarify.

You could also run it through PEiD. PEiD does not support 64-bit PEs, so it will choke if it's 64-bit.

There is also the famous GNU file for Windows. It will tell you all sorts of information about an executable.

Example:

$ file winrar-x64-392b1.exe
winrar-x64-392b1.exe: PE32+ executable for MS Windows (GUI)

$ file display.exe
display.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit</pre>

As you can see, the 64-bit WinRAR installer is classified as PE32+, which signifies a 64-bit executable. The 32-bit application is simply PE32, a 32-bit executable.

John T

Posted 2010-01-31T21:34:22.430

Reputation: 149 037

@Tom, with Process Explorer you can also do right-click/Properties/Image to see the image type if you don't want to add a column. – dangph – 2014-08-06T01:35:19.927

1You're very welcome :) – John T – 2010-02-01T02:03:16.053

Some applications that use Java (or possibly other runtimes) may not be recognizable in the TaskManger Processes tab although they are there. For these, look for the name in the Applications tab and when found right click and then choose the "Go To Process" option which will take you to the Processes tab with the correct process highlighted so you can see if the process has *32 appended to the process "Image Name". – Night Owl – 2014-11-26T07:28:04.163

In my case Taskmgr.exe is recognized as PE32 by GNU file, and as 64bit as per its own process list. – Xupicor – 2015-07-19T22:02:43.597

Definitely get the full package and not the "binaries" only one. I don't know why, but the binaries package always crashes for me while the full package (which is an installer, so likely does something extra) works fine. – Kat – 2015-11-06T19:11:12.480

1An alternative to Task Manager could be Process Explorer, you can add the Image Type column there. Through the Options menu you can replace Task Manager by this if you want to... :-) – Tamara Wijsman – 2010-09-03T15:07:35.137

What does GNU file show with programs like Process Explorer, which have a 32-bit stub that detects it's running on a 64-bit system and unpacks a 64-bit image to execute? – afrazier – 2010-09-04T12:43:56.150

Download it and try for yourself? – John T – 2010-09-04T14:43:57.997

2

To install file from GnuWin32, download 'complete package' (rather than 'binaries') from http://gnuwin32.sourceforge.net/packages/file.htm

– Colonel Panic – 2013-01-02T16:28:17.147

41

The easiest way, without installing another program or running the file, is just to right click on the file, choose Properties, and then go the the Compatibility tab. If there are no greyed out options and Windows XP and 9x modes are offered, it's 32-bit. If there are greyed out options and Vista is the earliest mode offered, it's 64-bit. No need to start the application at all.

If the application is already started, you can of course still use the *32 idea mentioned in other answers. However, this is not available in Windows 8.x and its new task manager. Fortunately, you can enable a Platform column by right-clicking on the column headers in the Details tab and choosing Select columns. The column will contain either "32-bit" or "64-bit" as appropriate.

trlkly

Posted 2010-01-31T21:34:22.430

Reputation: 1 236

The *32 notice is not available in the task manager of Windows 8 but it has a "Platform" column which, by default, is not visible. See http://www.7tutorials.com/3-ways-learn-whether-windows-program-64-bit-or-32-bit

– Pino – 2015-05-08T14:50:55.193

Thanks @Pino. I never had any reason to figure that out while I used Windows 8. (I went back to Windows 7 when my HD crashed and I realized I never used any W8 apps.) I'll update my answer. – trlkly – 2015-05-09T20:05:21.407

Sounds reasonable enough. – ArtOfWarfare – 2013-08-30T12:39:15.850

1Yeah I like this one. I want to check it for one single file and didn't want to load my laptop full of downloaded crap... – Gottlieb Notschnabel – 2014-02-13T10:11:04.957

24

If you got Visual Studio or the Platform SDK installed you can use dumpbin /headers to look at the PE header values.

Example for a 64-bit executable:

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
            8664 machine (x64)
               5 number of sections
        4987EDCA time date stamp Tue Feb 03 08:10:02 2009
               0 file pointer to symbol table
               0 number of symbols
              F0 size of optional header
              23 characteristics
                   Relocations stripped
                   Executable
                   Application can handle large (>2GB) addresses

OPTIONAL HEADER VALUES
             20B magic # (PE32+)
            8.00 linker version
           2A600 size of code
           18A00 size of initialized data
               0 size of uninitialized data
           2AE90 entry point (000000000042AE90)
            1000 base of code
               ...

And for 32 bit:

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               3 number of sections
        4B0C786D time date stamp Wed Nov 25 01:21:01 2009
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             103 characteristics
                   Relocations stripped
                   Executable
                   32 bit word machine

OPTIONAL HEADER VALUES
             10B magic # (PE32)
            9.00 linker version
           42000 size of code
            4000 size of initialized data
           6F000 size of uninitialized data
           B0EE0 entry point (004B0EE0)
           70000 base of code
               ...

The first value in the file header tells you the architecture: either 0x14C for x86 or 0x8664 for x64.

Joey

Posted 2010-01-31T21:34:22.430

Reputation: 36 381

Interesting and detailed approach, I really need to start programming again, +1. – John T – 2010-01-31T22:21:39.700

18

If you have a hex editor program, just open your file with it and shortly after the standard header intro stuff (like "This program cannot be run in DOS mode...") you will see either

"PE..L" (hex code: 504500004C) = 32 bit

or

"PE..d†" (hex code: 504500006486) = 64 bit

Brian Weigand

Posted 2010-01-31T21:34:22.430

Reputation: 181

@Nyerguds why ugly? it's called hexspeak and is quite commonly used, esp. in magic numbers. For example the IPv6 of facebook is *:FACE:B00C:*

– phuclv – 2017-03-24T13:09:50.827

That's not the same at all. You're just talking about hex leetspeak. This is literally using the number 100 as meaning "64" just because it looks like a 6 and a 4 in hexadecimal. – Nyerguds – 2017-03-25T22:36:48.860

@Nyerguds the string "6486" is in hex, which obviously is hexspeak where you read hex digits as characters. What's wrong with 0xDEADBEEF when you use 0xD for D because it looks like D? If it's ugly then BCD is also ugly where you literally use the number 100 to mean 64

– phuclv – 2017-03-31T15:35:02.793

I use Total Commander as my file manager, so for me, this is an the simplest solution. I can just press F3 to view the start of the file and have the answer instantly. – mivk – 2012-06-13T20:04:47.980

1Ew, they actually wrote "64" "86" as human-readable bytes in there to indicate 64 bit. How ugly :) – Nyerguds – 2014-04-28T06:27:29.043

5

alt textEXE Explorer
Executable File Explorer for OS/2, NE, PE32, PE32+ and VxD file types.

This application is based on MiTeC Portable Executable Reader. It reads and displays executable file properties and structure. It is compatible with PE32 (Portable Executable), PE32+ (64bit), NE (Windows 3.x New Executable) and VxD (Windows 9x Virtual Device Driver) file types. .NET executables are supported too.

It enumerates introduced classes, used units and forms for files compiled by Borland compilers.

Note: It comes with a GUI and lets you 'explore' the Windows binary file structure.
Sadly, it does not seem to even accept a target binary to open from the command line. But the detail it gives might be useful in some cases.

nik

Posted 2010-01-31T21:34:22.430

Reputation: 50 788

3

You can check using sigcheck.exe which is part of Sysinternals Suite, e.g.

$ sigcheck.exe some_app.exe

Sigcheck v2.51 - File version and signature viewer
Copyright (C) 2004-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

C:/Program Files (x86)/Foo App\some_app.exe:
    Verified:   Signed
    Signing date:   14:48 23/12/2015
    Publisher:  X
    Company:    X
    Description:    X
    Product:    Some App
    Prod version:   5.0.0.1241
    File version:   5.0.0.1241
    MachineType:    32-bit

kenorb

Posted 2010-01-31T21:34:22.430

Reputation: 16 795

1That also works for DLLs. – user34660 – 2016-09-11T07:45:32.390

2

Another simple way is to use PESnoop:

C:\> pesnoop photoshop.exe /pe_dh


-------------------------------------------------------------------------------
 PESnoop 2.0 - Advanced PE32/PE32+/COFF OBJ,LIB command line dumper by yoda
-------------------------------------------------------------------------------

Dump of file: photoshop.exe...
Modus:        64bit Portable Executable Image...
...

One place to get PESnoop is here: http://www.prestosoft.com/download/plugins/PESnoop.zip

-- Dave

ViperGeek

Posted 2010-01-31T21:34:22.430

Reputation: 368

2

And for you GUI enthusiasts, the absolute easiest way is to install this Explorer extension:

http://www.silurian.com/win32/inspect.htm

-- Dave

ViperGeek

Posted 2010-01-31T21:34:22.430

Reputation: 368

"Installation Failed". Yay. – ArtOfWarfare – 2013-08-30T12:35:00.270

2

Dependency Walker is a useful GUI tool to verify not only exe files but also DLL files. A 64 bit DLL or EXE file will have a little 64 icon next to it.

bobc

Posted 2010-01-31T21:34:22.430

Reputation: 21

1

filever /bad *.exe

WAMD64 or W32i or W16 will be in the first column.

Bob

Posted 2010-01-31T21:34:22.430

Reputation: 168

1

If you run the program, you can use "Process Monitor" (ProcMon) from Sysinternal Suite.

Its portable and gives you a lot of info about your processes.

yucer

Posted 2010-01-31T21:34:22.430

Reputation: 911

1That’s probably overkill. – Synetech – 2014-05-31T17:35:22.970