Determine Processor Arch. of Win PE (Portable Executable)

Share your advanced PureBasic knowledge/code with the community.
User avatar
bgeraghty
User
User
Posts: 52
Joined: Wed Apr 02, 2014 12:45 am
Location: irc.ibotched.it:+6697
Contact:

Determine Processor Arch. of Win PE (Portable Executable)

Post by bgeraghty »

Hello,

This short code can tell you whether a Windows PE file (*.exe) is 32-bit or 64-bit, using the built-in constants #PB_Processor_X64 and #PB_Processor_X86 as return values.

Code: Select all

EnableExplicit

#IMAGE_DOS_SIGNATURE = "5A4D"
#IMAGE_NT_SIGNATURE = "4550"
#IMAGE_FILE_MACHINE_X86 = "14C"
#IMAGE_FILE_MACHINE_X64 = "8664"

Procedure.i Get_PE_Architecture(exeFilePath.s) 
  Protected Result.i = 0 ; File Not Exist / Not a PE
  If FileExists(exeFilePath)
    If ReadFile(0, exeFilePath)
      Protected *fBuff = AllocateMemory(1024)
      ReadData(0, *fBuff, 1024)
      CloseFile(0)
      Protected *imageDosHeader.IMAGE_DOS_HEADER = *fBuff
      Protected *imageNTHeaders.IMAGE_NT_HEADERS = *fBuff + *imageDosHeader\e_lfanew
      ;Protected *imageSectionHeaders.IMAGE_SECTION_HEADERS = *imageNTHeaders\OptionalHeader + *imageNTHeaders\FileHeader\SizeOfOptionalHeader
      If Hex(*imageDosHeader\e_magic, #PB_Word) = #IMAGE_DOS_SIGNATURE And Hex(*imageNTHeaders\Signature, #PB_Word) = #IMAGE_NT_SIGNATURE
        Select Hex(*imageNTHeaders\FileHeader\Machine, #PB_Word)
          Case #IMAGE_FILE_MACHINE_X64
            Result = #PB_Processor_x64 ; 4
          Case #IMAGE_FILE_MACHINE_X86
            Result = #PB_Processor_x86 ; 2
        EndSelect
      EndIf
      FreeMemory(*fBuff)
    EndIf
  EndIf
  ProcedureReturn Result
EndProcedure
Last edited by bgeraghty on Fri Aug 24, 2018 9:13 am, edited 2 times in total.
SolveMyIssue_() - No QuickHelp available.
User avatar
bgeraghty
User
User
Posts: 52
Joined: Wed Apr 02, 2014 12:45 am
Location: irc.ibotched.it:+6697
Contact:

Re: Determine Processor Arch. of Win PE (Portable Executable

Post by bgeraghty »

*

Code: Select all

Procedure.b FileExists(FileFullPath.s, IsFolder.b=#False) ;BOOL File Exists, (Or Folder)
  Protected Result.b = #False 
  Select FileSize(FileFullPath) 
    Case -2 
      If IsFolder : Result = #True : Else : Result = #False : EndIf 
    Case -1
      Result = #False 
    Default 
      If IsFolder : Result = #False : Else : Result = #True : EndIf 
  EndSelect
  ProcedureReturn Result
EndProcedure
SolveMyIssue_() - No QuickHelp available.
User avatar
RSBasic
Moderator
Moderator
Posts: 1218
Joined: Thu Dec 31, 2009 11:05 pm
Location: Gernsbach (Germany)
Contact:

Re: Determine Processor Arch. of Win PE (Portable Executable

Post by RSBasic »

Thanks for the code. I only knew the WinAPI solution: GetBinaryType_()

Example:

Code: Select all

EnableExplicit

;Define lpApplicationName$ = "C:\...\YourFile.exe"
Define lpApplicationName$ = ProgramFilename()
Define lpBinaryType

#SCS_32BIT_BINARY = 0
#SCS_64BIT_BINARY = 6
#SCS_DOS_BINARY = 1
#SCS_OS216_BINARY = 5
#SCS_PIF_BINARY = 3
#SCS_POSIX_BINARY = 4
#SCS_WOW_BINARY = 2

GetBinaryType_(@lpApplicationName$,@lpBinaryType)

Select lpBinaryType
  Case #SCS_32BIT_BINARY
    MessageRequester("","A 32-bit Windows-based application.",0)
  Case #SCS_64BIT_BINARY
    MessageRequester("","A 64-bit Windows-based application.",0)
  Case #SCS_DOS_BINARY
    MessageRequester("","An MS-DOS-based application.",0)
  Case #SCS_OS216_BINARY
    MessageRequester("","A 16-bit OS/2-based application.",0)
  Case #SCS_PIF_BINARY
    MessageRequester("","A PIF file that executes an MS-DOS-based application.",0)
  Case #SCS_POSIX_BINARY
    MessageRequester("","A POSIX-based application.",0)
  Case #SCS_WOW_BINARY
    MessageRequester("","A 16-bit Windows-based application.",0)
EndSelect
Your code is better because it is platform-independent.
Image
Image
User avatar
Kwai chang caine
Always Here
Always Here
Posts: 5342
Joined: Sun Nov 05, 2006 11:42 pm
Location: Lyon - France

Re: Determine Processor Arch. of Win PE (Portable Executable

Post by Kwai chang caine »

Thanks for sharing 8)
ImageThe happiness is a road...
Not a destination
Post Reply