How to Check if .EXE File is 32 or 64 Bit
There are 2 different architectures for the Windows operating system which are the 32-bit or 64-bit, also known as x86 or x64. Although the rule of thumb for installing a 64-bit Windows applies mostly for computers with more than 4GB of memory, you will find that this is not the case today because branded computers such as Dell already pre-install Windows 10 64-bit onto a budget computer with 2GB of RAM. It is recommended to use the 64-bit applications in a 64-bit Windows operating system for better performance although the 32-bit will also work fine.
However do take note that attempting to run a 64-bit application on a 32-bit Windows will report a generic error saying “This app can’t run on your PC. To find a version for your PC, check with the software publisher”
Not all programs come with both 32-bit and 64-bit builds, so the availability of a 64-bit application would very much depend on the developer or a trusted third party to recompile the source code. From what we know, merely recompiling the source code for a 64-bit build doesn’t really help much in performance because the source code must register new hardware and instructions that aren’t available in 32-bit version of Windows.
If you’d like to determine if a particular application is a 32-bit or 64-bit build, here we have 10 ways to analyze the file with some methods that don’t even need to run the program.
1. PeStudioPeStudio is actually a powerful tool to detect anomalies in an application that are commonly found in malicious software and has been in continuous development since 2009. It is also easy enough to use by simply loading a file into PeStudio for an automated analysis and as you can see from the screenshot below, you can easily tell if the analyzed executable file is a 32-bit or 64-bit application by looking at the CPU row.
An advantage in PeStudio is you can analyze any files without running the suspicious files in the first place, thus keeping your computer safe. It also comes with a built-in VirusTotal scanner. PeStudio is portable and free for private non-commercial use.
2. InspectExe
InspectExe works slightly differently to PeStudio that we’ve mentioned above by integrating directly into Windows. The additional information of the program can be viewed by checking the program’s property window from the right click menu. Right click on any executable file, select Properties and you’ll find a few additional tabs such as InspectExe, Manifest, Imports, Sections and Resources. To determine if the file is a 64-bit program, simply refer to the information from the InspectExe tab.
InspectExe is a free application but a full version that offers the additional functionality of previewing resources in an executable file is available for purchase at $12. If you find yourself very often checking the resources of executable files, InspectExe would be a very convenient tool.
3. MiTeC EXE Explorer
MiTeC EXE Explorer is a single portable program that reads and displays the loaded executable file’s properties and structures which includes information on header, sections, directories, exports, imports, resources, strings, load config, debug, exceptions and even a hex viewer. Once a file is loaded and analyzed, you can easily tell if the program is a 64-bit from the information below the menubar. At the Header tab, the Machine row also shows the architecture of the program.
MiTeC EXE Explorer is also a freeware and it runs on Windows 2000 up to the current Windows 10.
4. Sigcheck
Sigcheck by Sysinternals is a simple command line tool that displays the file version, signature and surprisingly together with the information if the file is a 32-bit or 64-bit program. Interestingly they’ve also included the functionality of checking the file’s status in VirusTotal.
There is a third party frontend GUI for Sigcheck called SigcheckGUI which is more user friendly for people who are not familiar with command prompt usage. You can easily add multiple files, folders and even running processes for scanning.
Download Sigcheck | Download SigcheckGUI
5. EXE 64bit Detector
EXE 64bit Detector is yet another free tool created by SecurityXploded, a group that has released over a hundred useful tools. It is a simple command line tool that is only used to tell if a particular executable file is 32-bit or 64-bit.
Initially we couldn’t get this tool to work and after further testing, we found that this tool must be called from a UAC elevated command prompt or else the program will be terminated without showing any information.
6. 7-Zip
Most people would recognize the 7-Zip software as a file archiver program to extract or compress multiple files into a single file. However what most people don’t realize is the command line version of 7-Zip (7z.exe) can extract and display the PE header information for an executable program using the (l) switch.
It is certainly very useful for 7-Zip to have this feature because 7-Zip is commonly found installed on Windows computers as it is one of the most popular archivers, if not the most popular. Otherwise, you can also download the standalone command line version of 7-Zip and carry it with you on a USB flash drive.
7. VirusTotal
VirusTotal is a popular online free service to scan uploaded files using over 50 different antivirus programs. If you explore further on the scan results, you’ll find a lot of other information on the analyzed program including if the program is made for 32-bit or 64-bit machine. All you need to do is go to the “File detail” tab and refer to the PE header basic information area.
As you can see from the screenshot above, VirusTotal shows that the uploaded program is a x64 application which is also equivalent to 64-bit. As for 32-bit, it will show as x86. This method may not be the best solution if the file size of the program that you want to analyze is big because VirusTotal has a maximum file size of 128MB.
8. Task Manager
For a program that is already running, you can actually check from the Task Manager if it is a 32-bit or 64-bit application. Press Ctrl+Shift+Esc keys simultaneously to run Task Manager, click on the More Details button located at the bottom left. Go to Details tab, right click at the column header and choose “Select columns“. Scroll right to the bottom of the select columns window and tick the Platform checkbox followed by clicking the OK button. You will now see an additional Platform column where it displays if the running process is a 32-bit or 64-bit program.
Although this method doesn’t rely on any third party software or online services, it has a disadvantage whereby the program must be executed in order to show up in Task Manager. Obviously there are some risk if you’re trying to determine the build for an unknown program.
9. Notepad
Believe it or not, you can tell if the executable program is a 32-bit or 64-bit by loading it in Notepad. Run Notepad, drag and drop the program that you want to check into Notepad. You should see a lot of unknown and gibberish characters in Notepad which is normal. Now press Ctrl+F to bring up the Find dialog box in Notepad, type PE into the “find what” text box and click Find Next button. At the first result, take note of the first character after PE and some blank spaces. For a 32-bit program, you’ll see the letter L.
As for 64-bit program, it will show the letter d with a dagger †.
Before you try out this method, please be informed that loading a file that is huge in size will slow down your computer and possibly crash Notepad.
10. Referring Compatibility tab
Another interesting method to determine if an executable file is a 32-bit or 64-bit is by looking at the list of Windows operating systems available to select from the compatibility tab in the file properties window. First right click on the program that you want to analyze, select Properties and go to Compatibility tab. Tick the checkbox for “Run this program in compatibility mode for” and click at the drop down menu which will show you a list of Windows operating systems.
64-bit programs will only show Windows Vista and above.
While 32-bit programs will allow you to select back to Windows 95.
This option makes a lot of sense because although there is a 64-bit version for Windows XP, it wasn’t widely used. So Windows only allows you to run a 64-bit program in compatibility mode for Vista and above while 32-bit has been used since Windows 95.
Lovely the notepad one!!! Thanks Ray!
Thank you so much, Notepad one is really very good technique…
Nice one Raymond ! I suspect the grey transition period between 32 and 64-bit will last at least another couple of years, so this tool will be extremely useful in my toolkit. Thank you.
very nice article , saved it for offline help , sometimes I confused with 32 and 64 and thins write up is going to be immense help for me, kudos
Excellent..!!! Thanks Ray…:)