Page 1 of 1

Determine Processor Arch. of Win PE (Portable Executable)

Posted: Fri Aug 24, 2018 9:02 am
by bgeraghty
Hello,

This short code can tell you whether a Windows PE file (*.exe) is 32-bit or 64-bit, using the built-in constants #PB_Processor_X64 and #PB_Processor_X86 as return values.

Code: Select all

EnableExplicit

#IMAGE_DOS_SIGNATURE = "5A4D"
#IMAGE_NT_SIGNATURE = "4550"
#IMAGE_FILE_MACHINE_X86 = "14C"
#IMAGE_FILE_MACHINE_X64 = "8664"

Procedure.i Get_PE_Architecture(exeFilePath.s) 
  Protected Result.i = 0 ; File Not Exist / Not a PE
  If FileExists(exeFilePath)
    If ReadFile(0, exeFilePath)
      Protected *fBuff = AllocateMemory(1024)
      ReadData(0, *fBuff, 1024)
      CloseFile(0)
      Protected *imageDosHeader.IMAGE_DOS_HEADER = *fBuff
      Protected *imageNTHeaders.IMAGE_NT_HEADERS = *fBuff + *imageDosHeader\e_lfanew
      ;Protected *imageSectionHeaders.IMAGE_SECTION_HEADERS = *imageNTHeaders\OptionalHeader + *imageNTHeaders\FileHeader\SizeOfOptionalHeader
      If Hex(*imageDosHeader\e_magic, #PB_Word) = #IMAGE_DOS_SIGNATURE And Hex(*imageNTHeaders\Signature, #PB_Word) = #IMAGE_NT_SIGNATURE
        Select Hex(*imageNTHeaders\FileHeader\Machine, #PB_Word)
          Case #IMAGE_FILE_MACHINE_X64
            Result = #PB_Processor_x64 ; 4
          Case #IMAGE_FILE_MACHINE_X86
            Result = #PB_Processor_x86 ; 2
        EndSelect
      EndIf
      FreeMemory(*fBuff)
    EndIf
  EndIf
  ProcedureReturn Result
EndProcedure

Re: Determine Processor Arch. of Win PE (Portable Executable

Posted: Fri Aug 24, 2018 9:08 am
by bgeraghty
*

Code: Select all

Procedure.b FileExists(FileFullPath.s, IsFolder.b=#False) ;BOOL File Exists, (Or Folder)
  Protected Result.b = #False 
  Select FileSize(FileFullPath) 
    Case -2 
      If IsFolder : Result = #True : Else : Result = #False : EndIf 
    Case -1
      Result = #False 
    Default 
      If IsFolder : Result = #False : Else : Result = #True : EndIf 
  EndSelect
  ProcedureReturn Result
EndProcedure

Re: Determine Processor Arch. of Win PE (Portable Executable

Posted: Fri Aug 24, 2018 9:09 am
by RSBasic
Thanks for the code. I only knew the WinAPI solution: GetBinaryType_()

Example:

Code: Select all

EnableExplicit

;Define lpApplicationName$ = "C:\...\YourFile.exe"
Define lpApplicationName$ = ProgramFilename()
Define lpBinaryType

#SCS_32BIT_BINARY = 0
#SCS_64BIT_BINARY = 6
#SCS_DOS_BINARY = 1
#SCS_OS216_BINARY = 5
#SCS_PIF_BINARY = 3
#SCS_POSIX_BINARY = 4
#SCS_WOW_BINARY = 2

GetBinaryType_(@lpApplicationName$,@lpBinaryType)

Select lpBinaryType
  Case #SCS_32BIT_BINARY
    MessageRequester("","A 32-bit Windows-based application.",0)
  Case #SCS_64BIT_BINARY
    MessageRequester("","A 64-bit Windows-based application.",0)
  Case #SCS_DOS_BINARY
    MessageRequester("","An MS-DOS-based application.",0)
  Case #SCS_OS216_BINARY
    MessageRequester("","A 16-bit OS/2-based application.",0)
  Case #SCS_PIF_BINARY
    MessageRequester("","A PIF file that executes an MS-DOS-based application.",0)
  Case #SCS_POSIX_BINARY
    MessageRequester("","A POSIX-based application.",0)
  Case #SCS_WOW_BINARY
    MessageRequester("","A 16-bit Windows-based application.",0)
EndSelect
Your code is better because it is platform-independent.

Re: Determine Processor Arch. of Win PE (Portable Executable

Posted: Sun Aug 26, 2018 4:02 pm
by Kwai chang caine
Thanks for sharing 8)