Skip to content

Instantly share code, notes, and snippets.

@jftuga
Created February 5, 2018 04:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jftuga/97447fef14969cfe2a91988d953e26c0 to your computer and use it in GitHub Desktop.
Save jftuga/97447fef14969cfe2a91988d953e26c0 to your computer and use it in GitHub Desktop.
PowerShell Test-is64bit
function Test-is64Bit {
param($FilePath)
[int32]$MACHINE_OFFSET = 4
[int32]$PE_POINTER_OFFSET = 60
[byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096
$stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($FilePath, 'Open', 'Read')
$stream.Read($data, 0, 4096) | Out-Null
[int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET)
[int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET)
$result = "" | select FilePath, FileType, Is64Bit
$result.FilePath = $FilePath
$result.Is64Bit = $false
switch ($machineUint)
{
0 { $result.FileType = 'Native' }
0x014c { $result.FileType = 'x86' }
0x0200 { $result.FileType = 'Itanium' }
0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; }
}
$result
}
Test-is64bit $args[0]
@jftuga
Copy link
Author

jftuga commented Feb 5, 2018

To check a group of files:

dir *.exe | foreach { .\Test-is64bit.ps1 $_ } | Sort-Object Is64Bit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment