{"id":10607,"date":"2019-08-04T10:21:29","date_gmt":"2019-08-04T10:21:29","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=10607"},"modified":"2022-09-03T16:03:41","modified_gmt":"2022-09-03T10:33:41","slug":"find-out-if-a-program-exe-file-is-32-bit-or-64-bit","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/find-out-if-a-program-exe-file-is-32-bit-or-64-bit\/","title":{"rendered":"How to Check if a Program (.EXE or .DLL) is 32-bit or 64-bit"},"content":{"rendered":"

Software developers compile separate executable files (.EXE or .DLL) for 32-bit (x86) and 64-bit (x64) systems.\u00a0The 64-bit version of the program is usually denoted by suffixing 64<\/code> or x64<\/code> with the filename — e.g., sigcheck.exe vs. sigcheck64.exe. In some cases, the bitness<\/a> notation may be missing, and you may be wondering if the executable is 32-bit or 64-bit.<\/p>\n

This article discusses various methods to determine if a program or executable file is 32-bit or 64-bit in Windows.<\/p>\n

Note that some vendors may combine the 32-bit and 64-bit executables into one 32-bit self-extractor file that would detect the platform, extract, and run the correct EXE for the current platform.<\/p>\n

\n

Methods to check the bitness of a .exe or .dll:<\/h4>\n
    \n
  1. Using Task Manager<\/a><\/li>\n
  2. Using Resource Monitor<\/a><\/li>\n
  3. Using Process Explorer from Microsoft SysInternals<\/a><\/li>\n
  4. Using Sigcheck from Microsoft SysInternals<\/a><\/li>\n
  5. Using VirusTotal.com<\/a><\/li>\n
  6. Using Dependency Walker<\/a><\/li>\n
  7. Using a PE tool like MiTec Exe Explorer<\/a><\/li>\n
  8. Checking the file headers<\/a><\/li>\n
  9. Using 7-Zip command-line tool<\/a><\/li>\n
  10. Using the Properties\/Compatibility Tab<\/a><\/li>\n
  11. Using Dumpbin from Visual Studio tools<\/a><\/li>\n
  12. Using a VBScript to read Binary Streams<\/a><\/li>\n<\/ol>\n<\/div>\n
    \n

    Note<\/h4>\n

    32-bit programs can run seamlessly on a Windows 64-bit<\/a> Operating System using the WOW64 x86 emulator. But it won’t work the other way around.\u00a0Running a 64-bit application on Windows 32-bit causes the following error(s):<\/p>\n

    This version of [program.exe] is not compatible with the version of Windows you’re running. Check your computer’s system information to see whether you need a x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher<\/strong><\/div>\n
    program.exe is not a valid win32 application<\/strong><\/div>\n<\/div>\n

    Check if an executable (.exe or .dll) is 32-bit or 64-bit<\/h2>\n

    To find if a .exe or .dll is 32-bit or 64-bit, use one of these methods:<\/p>\n

    <\/a>Using Task Manager<\/h3>\n

    You can find the bitness of each running program in the Task Manager Details<\/strong> tab.<\/p>\n

      \n
    1. Open Task Manager and select the Details tab.<\/li>\n
    2. Right-click on the column header and click Select columns<\/strong>. The column header is the row that has the caption for each column, such as Name<\/strong>, PID<\/strong>, Status<\/strong>, etc.
      \n\"find<\/li>\n
    3. Enable the Platform<\/strong> checkbox and click OK.<\/li>\n<\/ol>\n

      In this example, I’ve opened both versions of Notepad.exe — one from Windows\\System32<\/code>, and the other (32-bit version) from Windows\\SysWOW64<\/code>. The Platform<\/strong> column in Task Manager shows the bitness of each executable.<\/p>\n

      \"find<\/p>\n

      However, this method works only for executable files, but not for DLLs. Moreover, the program needs to be running for you to check the details in Task Manager. Unlike GUI, command-line programs usually run and quit after finishing the task, before you can check the process details in Task Manager.<\/p>\n

      \n

      <\/a>Using Resource Monitor<\/h3>\n

      The Resource Monitor<\/a> tool displays information about the use of hardware (CPU, memory, disk, and network) and software (file handles and modules) resources in real-time.<\/p>\n

        \n
      1. Start the Resource Monitor by running resmon.exe<\/code> or perfmon.exe \/res<\/code><\/li>\n
      2. Launch the program whose bitness (32-bit or 64-bit) you want to know.<\/li>\n
      3. In Resource Monitor, click on the CPU tab.<\/li>\n
      4. In the Processes section, right-click on the column header, click Select Columns…<\/li>\n
      5. Enable the column named Platform<\/strong>.
        \n\"resource<\/li>\n<\/ol>\n

        The Platform column shows the info you’re looking for.<\/p>\n

        \n

        <\/a>Using Process Explorer from Microsoft SysInternals<\/h3>\n

        Task Manager lets you view the bitness of executable (.exe) files, but not DLLs. So, for .dll (as well as .exe) files, we’ll use Microsoft SysInternals’ Process Explorer<\/a> for this task, as Process Explorer can show the modules loaded<\/a> by a process. Follow these steps:<\/p>\n

          \n
        1. Download Process Explorer<\/strong> from the following link:\n
          https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/process-explorer<\/pre>\n<\/li>\n
        2. Right-click Start, click Run, and type the following command-line\/syntax:\n
          rundll32 \"path_to_filename.dll\",BlahBlah<\/pre>\n
          In this example, I’d type:<\/p>\n
          rundll32 \"D:\\Users\\ramesh\\Desktop\\downloader.dll\",BlahBlah<\/pre>\n
          (In this example, I’m trying to find the bitness of a file named downloader.dll<\/code>. The above command-line, with some bogus arguments, is simply for the sake of loading the DLL into the memory so that it shows up in Process Explorer.)<\/em><\/li>\n
        3. You’ll see the following error message box. Please do not close<\/strong> it yet.
          \n\"check<\/li>\n
        4. With the above error message dialog<\/a> kept open<\/strong>, launch Process Explorer.<\/li>\n
        5. In Process Explorer, from the Find<\/strong> menu, click Find Handle or DLL<\/strong> option. (More information<\/em><\/a> about this option.<\/em>)<\/li>\n
        6. Type downloader.dll<\/code> in the search box and click Search.<\/li>\n
        7. When you see the process rundll32.exe<\/code> in the list, click on it. This highlights the DLL file in the lower pane window.
          \n\"check<\/li>\n
        8. Double-click on downloader.dll<\/code> entry on the lower pane. You’ll see this properties dialog that shows the bitness (32-bit or 64-bit) of the module.
          \n\"check<\/li>\n
        9. Click Ok, and exit Process Explorer.<\/li>\n<\/ol>\n
          \"tipsAdditional Tip:<\/strong> You must run Process Explorer as administrator to manage processes that are running elevated. To elevate Process Explorer, click the File menu \u2192 Show Details for All Processes<\/strong>.<\/em><\/p>\n
          \n
          <\/a>Using Sigcheck from Microsoft SysInternals<\/h3>\n
          Sigcheck<\/a> is a command-line utility from Microsoft Windows SysInternals that shows the file version number, timestamp information, and digital signature details, including certificate chains. To output also shows the bitness of the executable.<\/p>\n
          Examples:<\/strong><\/p>\n
          sigcheck.exe c:\\windows\\system32\\shell32.dll<\/pre>\n
          sigcheck.exe C:\\Windows\\Notepad.exe<\/pre>\n
          Output:<\/strong><\/p>\n
          Sigcheck v2.54 - File version and signature viewer\r\nCopyright (C) 2004-2016 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\nc:\\windows\\notepad.exe:\r\nVerified: Signed\r\nSigning date: 11:14 AM 6\/21\/2019\r\nPublisher: Microsoft Windows\r\nCompany: Microsoft Corporation\r\nDescription: Notepad\r\nProduct: Microsoft\u00ab Windows\u00ab Operating System\r\nProd version: 10.0.18362.1\r\nFile version: 10.0.18362.1 (WinBuild.160101.0800)\r\nMachineType: 64-bit<\/strong><\/pre>\n
          Running Sigcheck on a file named downloader.dll<\/code> showed that the file is 32-bit.<\/p>\n
          \"check<\/p>\n
          \n
          <\/a>Using VirusTotal.com<\/h3>\n
          The VirusTotal.com<\/code> portal helps you analyze suspicious files and URLs to detect malware and automatically share them with the security community. You can upload a suspicious file, search the VirusTotal database using the file name, hash<\/a>, domain name as the keyword.<\/p>\n