Created
February 5, 2018 04:28
-
-
Save jftuga/97447fef14969cfe2a91988d953e26c0 to your computer and use it in GitHub Desktop.
PowerShell Test-is64bit
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
function Test-is64Bit { | |
param($FilePath) | |
[int32]$MACHINE_OFFSET = 4 | |
[int32]$PE_POINTER_OFFSET = 60 | |
[byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096 | |
$stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($FilePath, 'Open', 'Read') | |
$stream.Read($data, 0, 4096) | Out-Null | |
[int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET) | |
[int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET) | |
$result = "" | select FilePath, FileType, Is64Bit | |
$result.FilePath = $FilePath | |
$result.Is64Bit = $false | |
switch ($machineUint) | |
{ | |
0 { $result.FileType = 'Native' } | |
0x014c { $result.FileType = 'x86' } | |
0x0200 { $result.FileType = 'Itanium' } | |
0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; } | |
} | |
$result | |
} | |
Test-is64bit $args[0] |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
To check a group of files:
dir *.exe | foreach { .\Test-is64bit.ps1 $_ } | Sort-Object Is64Bit