Quick way to tell if an installed application is 64-bit or 32-bit

"If you run the application, in Task Manager it should have a *32 beside it to indicate it's 32-bit. I'm pretty sure they had this implemented in Server 2003, not positive though, hopefully someone can clarify.

You could also run it through PEiD. PEiD does not support 64-bit PEs, so it will choke if it's 64-bit.

There is also the famous GNU file for Windows. It will tell you all sorts of information about an executable.

Example:

$ file winrar-x64-392b1.exe
winrar-x64-392b1.exe: PE32+ executable for MS Windows (GUI)

$ file display.exe
display.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit</pre>

As you can see, the 64-bit WinRAR installer is classified as PE32+, which signifies a 64-bit executable. The 32-bit application is simply PE32, a 32-bit executable."

"If you got Visual Studio or the Platform SDK installed you can use dumpbin /headers to look at the PE header values.

Example for a 64-bit executable:

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
8664 machine (x64)
5 number of sections
4987EDCA time date stamp Tue Feb 03 08:10:02 2009
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
23 characteristics
Relocations stripped
Executable
Application can handle large (>2GB) addresses

OPTIONAL HEADER VALUES
20B magic # (PE32+)
8.00 linker version
2A600 size of code
18A00 size of initialized data
0 size of uninitialized data
2AE90 entry point (000000000042AE90)
1000 base of code
...

And for 32 bit:

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
14C machine (x86)
3 number of sections
4B0C786D time date stamp Wed Nov 25 01:21:01 2009
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
103 characteristics
Relocations stripped
Executable
32 bit word machine

OPTIONAL HEADER VALUES
10B magic # (PE32)
9.00 linker version
42000 size of code
4000 size of initialized data
6F000 size of uninitialized data
B0EE0 entry point (004B0EE0)
70000 base of code
...

The first value in the file header tells you the architecture: either 0x14C for x86 or 0x8664 for x64."

"You can check using sigcheck.exe which is part of Sysinternals Suite, e.g.

$ sigcheck.exe some_app.exe

Sigcheck v2.51 - File version and signature viewer
Copyright © 2004-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

C:/Program Files (x86)/Foo App\some_app.exe:
Verified: Signed
Signing date: 14:48 23/12/2015
Publisher: X
Company: X
Description: X
Product: Some App
Prod version: 5.0.0.1241
File version: 5.0.0.1241
MachineType: 32-bit"

"Another simple way is to use PESnoop:

C:\> pesnoop photoshop.exe /pe_dh

-------------------------------------------------------------------------------
PESnoop 2.0 - Advanced PE32/PE32+/COFF OBJ,LIB command line dumper by yoda
-------------------------------------------------------------------------------

Dump of file: photoshop.exe...
Modus: 64bit Portable Executable Image...
...

One place to get PESnoop is here: http://www.prestosoft.com/download/plugins/PESnoop.zip

-- Dave"

"And for you GUI enthusiasts, the absolute easiest way is to install this Explorer extension:

http://www.silurian.com/win32/inspect.htm

-- Dave"