How can I test a Windows DLL file to determine if it is 32 bit or 64 bit? [duplicate]

A crude way would be to call dumpbin with the headers option from the Visual Studio tools on each DLL and look for the appropriate output:

dumpbin /headers my32bit.dllPE signature foundFile Type: DLLFILE HEADER VALUES             14C machine (x86)               1 number of sections        45499E0A time date stamp Thu Nov 02 03:28:10 2006               0 file pointer to symbol table               0 number of symbols              E0 size of optional header            2102 characteristics                   Executable                   32 bit word machine                   DLLOPTIONAL HEADER VALUES             10B magic # (PE32)

You can see a couple clues in that output that it is a 32 bit DLL, including the 14C value that Paul mentions. Should be easy to look for in a script.

If you have Cygwin installed (which I strongly recommend for a variety of reasons), you could use the 'file' utility on the DLL

file <filename>

which would give an output like this:

icuuc36.dll: MS-DOS executable PE  for MS Windows (DLL) (GUI) Intel 80386 32-bit

Gory details

A DLL uses the PE executable format, and it's not too tricky to read that information out of the file.

See this MSDN article on the PE File Format for an overview. You need to read the MS-DOS header, then read the IMAGE_NT_HEADERS structure. This contains the IMAGE_FILE_HEADER structure which contains the info you need in the Machine member which contains one of the following values

• IMAGE_FILE_MACHINE_I386 (0x014c)
• IMAGE_FILE_MACHINE_IA64 (0x0200)
• IMAGE_FILE_MACHINE_AMD64 (0x8664)

This information should be at a fixed offset in the file, but I'd still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE_NT_HEADERS to be sure you cope with any future changes.

Use ImageHelp to read the headers...

You can also use the ImageHelp API to do this - load the DLL with LoadImage and you'll get a LOADED_IMAGE structure which will contain a pointer to an IMAGE_NT_HEADERS structure. Deallocate the LOADED_IMAGE with ImageUnload.

...or adapt this rough Perl script

Here's rough Perl script which gets the job done. It checks the file has a DOS header, then reads the PE offset from the IMAGE_DOS_HEADER 60 bytes into the file.

It then seeks to the start of the PE part, reads the signature and checks it, and then extracts the value we're interested in.

#!/usr/bin/perl## usage: petype <exefile>#$exe = $ARGV[0];open(EXE, $exe) or die "can't open $exe: $!";binmode(EXE);if (read(EXE, $doshdr, 64)) {   ($magic,$skip,$offset)=unpack('a2a58l', $doshdr);   die("Not an executable") if ($magic ne 'MZ');   seek(EXE,$offset,SEEK_SET);   if (read(EXE, $pehdr, 6)){       ($sig,$skip,$machine)=unpack('a2a2v', $pehdr);       die("No a PE Executable") if ($sig ne 'PE');       if ($machine == 0x014c){            print "i386\n";       }       elsif ($machine == 0x0200){            print "IA64\n";       }       elsif ($machine == 0x8664){            print "AMD64\n";       }       else{            printf("Unknown machine type 0x%lx\n", $machine);       }   }}close(EXE);