I need to detect whether a given .dll or .exe file is 32 bit or 64 bit
我需要检测给定的.dll或.exe文件是32位还是64位
At the moment I have only one solution: read the PE Header from the specified file and take the 'Machine' field from there.
目前我只有一个解决方案:从指定文件中读取PE标头并从那里取出“机器”字段。
( Specification: Microsoft Portable Executable and Common Object File Format Specification (.docx file) at section "3.3. COFF File Header (Object and Image)" )
(规范:Microsoft可移植可执行文件和通用目标文件格式规范(.docx文件),参见“3.3.COFF文件头(对象和图像)”部分)
This field can take up to about 20 values. Three of them are:
此字段最多可包含约20个值。其中三个是:
IMAGE_FILE_MACHINE_I386 ( == 32bit )
IMAGE_FILE_MACHINE_IA64 ( == 64bit )
IMAGE_FILE_MACHINE_AMD64 ( == 64bit )
My questions:
1) Is 'Machine' to bitness mapping correct or did I miss something? Are there any other caveats?
1)“机器”的位图映射是正确的还是我错过了什么?还有其他警告吗?
2) Is there easier way to detect 32/64 bitness (probably some specific field in PE format I didn't notice or some special system function)?
2)是否有更简单的方法来检测32/64位数(可能是PE格式的某些特定字段我没有注意到或某些特殊的系统功能)?
2 个解决方案
#1
GetBinaryType(...) returns SCS_32BIT_BINARY for a 32-bit Windows-based application and SCS_64BIT_BINARY for a 64-bit Windows-based application.
对于基于Windows的32位应用程序,GetBinaryType(...)返回SCS_32BIT_BINARY,对于64位基于Windows的应用程序,返回SCS_64BIT_BINARY。
#2
Check this: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx Look for "Magic" member - you can find out whether PE header is 32 bit(PE32) or 64 bit(PE32+).
检查一下:http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx寻找“魔术”成员 - 你可以看出PE头是否是32位(PE32)或64位(PE32 +)。
#1
GetBinaryType(...) returns SCS_32BIT_BINARY for a 32-bit Windows-based application and SCS_64BIT_BINARY for a 64-bit Windows-based application.
对于基于Windows的32位应用程序,GetBinaryType(...)返回SCS_32BIT_BINARY,对于64位基于Windows的应用程序,返回SCS_64BIT_BINARY。
#2
Check this: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx Look for "Magic" member - you can find out whether PE header is 32 bit(PE32) or 64 bit(PE32+).
检查一下:http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx寻找“魔术”成员 - 你可以看出PE头是否是32位(PE32)或64位(PE32 +)。