[Windows] Determining if a binary is built for x86 or x64 target

B

BillLeeLee

[H]F Junkie
Joined
Jul 2, 2003
Messages
13,486
Hi everyone,

I'm rebuilding the tool chain we use at work so that everything is 64-bit, and I can rebuild everything fine, but I don't know if the executables and libraries I'm building are actually 64-bit. Is there a tool or some way to determine if a binary is built for the x64 architecture or x86 architecture?

OS: Windows XP x64

Currently I have Visual Studio 2005 as my dev environment.

My google-fu is failing me on this one.

Thanks.
 
process explorer can tell you if a running process is 64bit or 32-bit. I dont think this column is enabled by default though. I dont think this would help you for dlls though.
 
Under "Image Name," there will be an "*32" for each 32-bit process.
 
Thanks for the replies guys. That will show that a process is running natively as 64-bit or being run as 32-bit code, but I still need a solution for objects like DLLs. Hmmm.
 
theres a tool that comes with visual studio that will tell you all that crap. I'll check it out when I'm at work tomorrow.
 
Are you trying to do this programatically, or with a tool interactively, Bill?

If you want to do it interactively, you should use the DUMPBIN tool, which is included in Visual Studio. With the /HEADERS option, you'll see the machine flag in the header. For an X86 image, you'll see this:

Code: 
D:\projects\AddressCounter>dumpbin /headers x64\debug\AddressCounter.exe
Microsoft (R) COFF/PE Dumper Version 8.00.50727.762
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file x64\debug\AddressCounter.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
            8664 machine (x64)
               6 number of sections
        4856624F time date stamp Mon Jun 16 05:53:35 2008
               0 file pointer to symbol table
               0 number of symbols
              F0 size of optional header
              23 characteristics
                   Relocations stripped
                   Executable
                   Application can handle large (>2GB) addresses
[...]

and for a 32-bit image, you'll see this:

Code: 
Dump of file \debug\AddressCounter.exe
DUMPBIN : fatal error LNK1181: cannot open input file '\debug\AddressCounter.exe'

D:\projects\AddressCounter>dumpbin /headers debug\AddressCounter.exe
Microsoft (R) COFF/PE Dumper Version 8.00.50727.762
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file debug\AddressCounter.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               6 number of sections
        46E5618E time date stamp Mon Sep 10 08:23:58 2007
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             103 characteristics
                   Relocations stripped
                   Executable
                   32 bit word machine
[...]

The "characteristics" flags and "machine" flags are different. I don't have an IA64 image handy, but that will also produce different results.

If you want to do it programatically, you can open the EXE using the ImageLoad() API in the ImageHelp library. This will get you a pointer to a LOADED_IMAGE structure, which contains a pointer to the IMAGE_NT_HEADERS block, which includes the IMAGE_FILE_HEADER structure, which contains the Machine and Characteristics bits you're interested in. It's the same information DUMPBIN /HEADERS displays, using the same APIs it uses to display it.
 
Hi mikeblas,

Thank you very much for the response.

I was looking to do it interactively. I'm rebuilding the Trolltech Qt libraries in 64-bit and wanted to make sure the .libs it produced were really 64-bit before I followed up with some other concerns.

dumpbin.exe is just what I needed, and now I know how to do it programmatically if the need ever arises.

Thanks everyone.
 
You must log in or register to reply here.
Back
Top