How can I test a Windows DLL file to determine if it is 32 bit or 64 bit

Question

I d like to write a test script or program that asserts that all DLL files in a given directory are of a particular build type   I would use this as a sanity check at the end of a build process on an SDK to make sure that the 64-bit version hasn t somehow got some 32-bit DLL files in it and vice versa   Is there an easy way to look at a DLL file and determine its type   The solution should work on both xp32 and xp64

User · Answer

A crude way would be to call dumpbin with the headers option from the Visual Studio tools on each DLL and look for the appropriate output:

dumpbin /headers my32bit.dll

PE signature found

File Type: DLL

FILE HEADER VALUES
             14C machine (x86)
               1 number of sections
        45499E0A time date stamp Thu Nov 02 03:28:10 2006
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
            2102 characteristics
                   Executable
                   32 bit word machine
                   DLL

OPTIONAL HEADER VALUES
             10B magic # (PE32)

You can see a couple clues in that output that it is a 32 bit DLL, including the 14C value that Paul mentions. Should be easy to look for in a script.

User · Answer

Gory details  A DLL uses the PE executable format  and it s not too tricky to read that information out of the file   See this MSDN article on the PE File Format for an overview  You need to read the MS-DOS header  then read the IMAGE NT HEADERS structure  This contains the IMAGE FILE HEADER structure which contains the info you need in the Machine member which contains one of the following values   IMAGE FILE MACHINE I386  0x014c  IMAGE FILE MACHINE IA64  0x0200  IMAGE FILE MACHINE AMD64  0x8664    This information should be at a fixed offset in the file  but I d still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE NT HEADERS to be sure you cope with any future changes    Use ImageHelp to read the headers     You can also use the ImageHelp API to do this - load the DLL with LoadImage and you ll get a LOADED IMAGE structure which will contain a pointer to an IMAGE NT HEADERS structure  Deallocate the LOADED IMAGE with ImageUnload      or adapt this rough Perl script  Here s rough Perl script which gets the job done  It checks the file has a DOS header  then reads the PE offset from the IMAGE DOS HEADER 60 bytes into the file   It then seeks to the start of the PE part  reads the signature and checks it  and then extracts the value we re interested in      usr bin perl     usage  petype  lt exefile gt     exe    ARGV 0    open EXE   exe  or die  can t open  exe       binmode EXE   if  read EXE   doshdr  64           magic  skip  offset  unpack  a2a58l    doshdr      die  Not an executable   if   magic ne  MZ        seek EXE  offset SEEK SET      if  read EXE   pehdr  6             sig  skip  machine  unpack  a2a2v    pehdr          die  No a PE Executable   if   sig ne  PE            if   machine    0x014c               print  i386 n                   elsif   machine    0x0200               print  IA64 n                   elsif   machine    0x8664               print  AMD64 n                   else              printf  Unknown machine type 0x lx n    machine                    close EXE

User · Answer

If you have Cygwin installed  which I strongly recommend for a variety of reasons   you could use the  file  utility on the DLL  file  lt filename gt    which would give an output like this   icuuc36 dll  MS-DOS executable PE  for MS Windows  DLL   GUI  Intel 80386 32-bit

User · Answer

Dependency Walker tells all well almost    http   www dependencywalker com   It does not  install  -just get it  extract it and run the exec  It works for any x32 or x64 windows module application   As I recall it is fairly straightforward to see all dependencies  i e  the  dll modules  and since the appl  is a sum of the dependencies one can ascertain if it is full x64  x32 x86  or a bit of each    Type of CPU that the module was built for is in the  CPU  column   Most 64-bit aps are still a bit of each but 32-bit ap w b all x86    Beautiful program for geeks programmers and it is free

User · Answer

If you have Cygwin installed  which I strongly recommend for a variety of reasons   you could use the  file  utility on the DLL  file  lt filename gt    which would give an output like this   icuuc36 dll  MS-DOS executable PE  for MS Windows  DLL   GUI  Intel 80386 32-bit

User · Answer

Dependency Walker tells all well almost    http   www dependencywalker com   It does not  install  -just get it  extract it and run the exec  It works for any x32 or x64 windows module application   As I recall it is fairly straightforward to see all dependencies  i e  the  dll modules  and since the appl  is a sum of the dependencies one can ascertain if it is full x64  x32 x86  or a bit of each    Type of CPU that the module was built for is in the  CPU  column   Most 64-bit aps are still a bit of each but 32-bit ap w b all x86    Beautiful program for geeks programmers and it is free

User · Answer

If you have Cygwin installed  which I strongly recommend for a variety of reasons   you could use the  file  utility on the DLL  file  lt filename gt    which would give an output like this   icuuc36 dll  MS-DOS executable PE  for MS Windows  DLL   GUI  Intel 80386 32-bit

User · Answer

I have written a very simple tool that does exactly that - it s called PE Deconstructor   Simply fire it up and load your DLL file     In the example above  the loaded DLL is 32-bit   You can download it here  I only have the 64-bit version compiled ATM   http   files quickmediasolutions com exe pedeconstructor 0 1 amd64 exe  An older 32-bit version is available here  http   dl dropbox com u 31080052 pedeconstructor zip

User · Answer

If you have Cygwin installed  which I strongly recommend for a variety of reasons   you could use the  file  utility on the DLL  file  lt filename gt    which would give an output like this   icuuc36 dll  MS-DOS executable PE  for MS Windows  DLL   GUI  Intel 80386 32-bit

User · Answer

A crude way would be to call dumpbin with the headers option from the Visual Studio tools on each DLL and look for the appropriate output:

dumpbin /headers my32bit.dll

PE signature found

File Type: DLL

FILE HEADER VALUES
             14C machine (x86)
               1 number of sections
        45499E0A time date stamp Thu Nov 02 03:28:10 2006
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
            2102 characteristics
                   Executable
                   32 bit word machine
                   DLL

OPTIONAL HEADER VALUES
             10B magic # (PE32)

You can see a couple clues in that output that it is a 32 bit DLL, including the 14C value that Paul mentions. Should be easy to look for in a script.

User · Answer

Gory details  A DLL uses the PE executable format  and it s not too tricky to read that information out of the file   See this MSDN article on the PE File Format for an overview  You need to read the MS-DOS header  then read the IMAGE NT HEADERS structure  This contains the IMAGE FILE HEADER structure which contains the info you need in the Machine member which contains one of the following values   IMAGE FILE MACHINE I386  0x014c  IMAGE FILE MACHINE IA64  0x0200  IMAGE FILE MACHINE AMD64  0x8664    This information should be at a fixed offset in the file  but I d still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE NT HEADERS to be sure you cope with any future changes    Use ImageHelp to read the headers     You can also use the ImageHelp API to do this - load the DLL with LoadImage and you ll get a LOADED IMAGE structure which will contain a pointer to an IMAGE NT HEADERS structure  Deallocate the LOADED IMAGE with ImageUnload      or adapt this rough Perl script  Here s rough Perl script which gets the job done  It checks the file has a DOS header  then reads the PE offset from the IMAGE DOS HEADER 60 bytes into the file   It then seeks to the start of the PE part  reads the signature and checks it  and then extracts the value we re interested in      usr bin perl     usage  petype  lt exefile gt     exe    ARGV 0    open EXE   exe  or die  can t open  exe       binmode EXE   if  read EXE   doshdr  64           magic  skip  offset  unpack  a2a58l    doshdr      die  Not an executable   if   magic ne  MZ        seek EXE  offset SEEK SET      if  read EXE   pehdr  6             sig  skip  machine  unpack  a2a2v    pehdr          die  No a PE Executable   if   sig ne  PE            if   machine    0x014c               print  i386 n                   elsif   machine    0x0200               print  IA64 n                   elsif   machine    0x8664               print  AMD64 n                   else              printf  Unknown machine type 0x lx n    machine                    close EXE

User · Answer

I have written a very simple tool that does exactly that - it s called PE Deconstructor   Simply fire it up and load your DLL file     In the example above  the loaded DLL is 32-bit   You can download it here  I only have the 64-bit version compiled ATM   http   files quickmediasolutions com exe pedeconstructor 0 1 amd64 exe  An older 32-bit version is available here  http   dl dropbox com u 31080052 pedeconstructor zip

User · Answer

A crude way would be to call dumpbin with the headers option from the Visual Studio tools on each DLL and look for the appropriate output:

dumpbin /headers my32bit.dll

PE signature found

File Type: DLL

FILE HEADER VALUES
             14C machine (x86)
               1 number of sections
        45499E0A time date stamp Thu Nov 02 03:28:10 2006
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
            2102 characteristics
                   Executable
                   32 bit word machine
                   DLL

OPTIONAL HEADER VALUES
             10B magic # (PE32)

You can see a couple clues in that output that it is a 32 bit DLL, including the 14C value that Paul mentions. Should be easy to look for in a script.

User · Answer

Gory details  A DLL uses the PE executable format  and it s not too tricky to read that information out of the file   See this MSDN article on the PE File Format for an overview  You need to read the MS-DOS header  then read the IMAGE NT HEADERS structure  This contains the IMAGE FILE HEADER structure which contains the info you need in the Machine member which contains one of the following values   IMAGE FILE MACHINE I386  0x014c  IMAGE FILE MACHINE IA64  0x0200  IMAGE FILE MACHINE AMD64  0x8664    This information should be at a fixed offset in the file  but I d still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE NT HEADERS to be sure you cope with any future changes    Use ImageHelp to read the headers     You can also use the ImageHelp API to do this - load the DLL with LoadImage and you ll get a LOADED IMAGE structure which will contain a pointer to an IMAGE NT HEADERS structure  Deallocate the LOADED IMAGE with ImageUnload      or adapt this rough Perl script  Here s rough Perl script which gets the job done  It checks the file has a DOS header  then reads the PE offset from the IMAGE DOS HEADER 60 bytes into the file   It then seeks to the start of the PE part  reads the signature and checks it  and then extracts the value we re interested in      usr bin perl     usage  petype  lt exefile gt     exe    ARGV 0    open EXE   exe  or die  can t open  exe       binmode EXE   if  read EXE   doshdr  64           magic  skip  offset  unpack  a2a58l    doshdr      die  Not an executable   if   magic ne  MZ        seek EXE  offset SEEK SET      if  read EXE   pehdr  6             sig  skip  machine  unpack  a2a2v    pehdr          die  No a PE Executable   if   sig ne  PE            if   machine    0x014c               print  i386 n                   elsif   machine    0x0200               print  IA64 n                   elsif   machine    0x8664               print  AMD64 n                   else              printf  Unknown machine type 0x lx n    machine                    close EXE

User · Answer

A crude way would be to call dumpbin with the headers option from the Visual Studio tools on each DLL and look for the appropriate output:

dumpbin /headers my32bit.dll

PE signature found

File Type: DLL

FILE HEADER VALUES
             14C machine (x86)
               1 number of sections
        45499E0A time date stamp Thu Nov 02 03:28:10 2006
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
            2102 characteristics
                   Executable
                   32 bit word machine
                   DLL

OPTIONAL HEADER VALUES
             10B magic # (PE32)

You can see a couple clues in that output that it is a 32 bit DLL, including the 14C value that Paul mentions. Should be easy to look for in a script.

User · Answer

Gory details  A DLL uses the PE executable format  and it s not too tricky to read that information out of the file   See this MSDN article on the PE File Format for an overview  You need to read the MS-DOS header  then read the IMAGE NT HEADERS structure  This contains the IMAGE FILE HEADER structure which contains the info you need in the Machine member which contains one of the following values   IMAGE FILE MACHINE I386  0x014c  IMAGE FILE MACHINE IA64  0x0200  IMAGE FILE MACHINE AMD64  0x8664    This information should be at a fixed offset in the file  but I d still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE NT HEADERS to be sure you cope with any future changes    Use ImageHelp to read the headers     You can also use the ImageHelp API to do this - load the DLL with LoadImage and you ll get a LOADED IMAGE structure which will contain a pointer to an IMAGE NT HEADERS structure  Deallocate the LOADED IMAGE with ImageUnload      or adapt this rough Perl script  Here s rough Perl script which gets the job done  It checks the file has a DOS header  then reads the PE offset from the IMAGE DOS HEADER 60 bytes into the file   It then seeks to the start of the PE part  reads the signature and checks it  and then extracts the value we re interested in      usr bin perl     usage  petype  lt exefile gt     exe    ARGV 0    open EXE   exe  or die  can t open  exe       binmode EXE   if  read EXE   doshdr  64           magic  skip  offset  unpack  a2a58l    doshdr      die  Not an executable   if   magic ne  MZ        seek EXE  offset SEEK SET      if  read EXE   pehdr  6             sig  skip  machine  unpack  a2a2v    pehdr          die  No a PE Executable   if   sig ne  PE            if   machine    0x014c               print  i386 n                   elsif   machine    0x0200               print  IA64 n                   elsif   machine    0x8664               print  AMD64 n                   else              printf  Unknown machine type 0x lx n    machine                    close EXE

[windows] How can I test a Windows DLL file to determine if it is 32 bit or 64 bit?

Examples related to windows

Examples related to dll

Examples related to 32bit-64bit