This short code can tell you whether a Windows PE file (*.exe) is 32-bit or 64-bit, using the built-in constants #PB_Processor_X64 and #PB_Processor_X86 as return values.
Code: Select all
EnableExplicit
#IMAGE_DOS_SIGNATURE = "5A4D"
#IMAGE_NT_SIGNATURE = "4550"
#IMAGE_FILE_MACHINE_X86 = "14C"
#IMAGE_FILE_MACHINE_X64 = "8664"
Procedure.i Get_PE_Architecture(exeFilePath.s)
Protected Result.i = 0 ; File Not Exist / Not a PE
If FileExists(exeFilePath)
If ReadFile(0, exeFilePath)
Protected *fBuff = AllocateMemory(1024)
ReadData(0, *fBuff, 1024)
CloseFile(0)
Protected *imageDosHeader.IMAGE_DOS_HEADER = *fBuff
Protected *imageNTHeaders.IMAGE_NT_HEADERS = *fBuff + *imageDosHeader\e_lfanew
;Protected *imageSectionHeaders.IMAGE_SECTION_HEADERS = *imageNTHeaders\OptionalHeader + *imageNTHeaders\FileHeader\SizeOfOptionalHeader
If Hex(*imageDosHeader\e_magic, #PB_Word) = #IMAGE_DOS_SIGNATURE And Hex(*imageNTHeaders\Signature, #PB_Word) = #IMAGE_NT_SIGNATURE
Select Hex(*imageNTHeaders\FileHeader\Machine, #PB_Word)
Case #IMAGE_FILE_MACHINE_X64
Result = #PB_Processor_x64 ; 4
Case #IMAGE_FILE_MACHINE_X86
Result = #PB_Processor_x86 ; 2
EndSelect
EndIf
FreeMemory(*fBuff)
EndIf
EndIf
ProcedureReturn Result
EndProcedure