how to figure out the target cpu architecture (x64 / x86) for which a binary was buil

NTDEV
1

Hi,

I have several sys files (driver files).

Some off them are for 64 Bit and some of them for 32 Bit.

I have two abc.sys files but I do not know which one is for 32 Bit and which one is for 64 Bit.

How can I figure that out?

I guess inside those files is something like a header with meta data. I guess there is also a flag in those meta data that say 32 or 64 Bit. Is there a tool that can check binaries *.sys, *.exe … And that can tell me for which cpu architecture such a file was build?

Thanks in advance for all help full answers.

2

xxxxx@siemens.com wrote:

I have several sys files (driver files).

Some off them are for 64 Bit and some of them for 32 Bit.

I have two abc.sys files but I do not know which one is for 32 Bit and which one is for 64 Bit.

How can I figure that out?

I guess inside those files is something like a header with meta data. I guess there is also a flag in those meta data that say 32 or 64 Bit. Is there a tool that can check binaries *.sys, *.exe … And that can tell me for which cpu architecture such a file was build?

C:\tmp> *link /dump /headers drv\32\vidousb.sys*
Microsoft (R) COFF/PE Dumper Version 9.00.21022.08
Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file drv\32\vidousb.sys

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
14C machine (x86)
7 number of sections
4D7E8BF3 time date stamp Mon Mar 14 14:43:15 2011
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
102 characteristics
Executable
32 bit word machine
…

C:\tmp> *link /dump /headers drv\64\vidousb.sys*
Microsoft (R) COFF/PE Dumper Version 9.00.21022.08
Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file drv\64\vidousb.sys

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
8664 machine (x64)
8 number of sections
4D7E8C30 time date stamp Mon Mar 14 14:44:16 2011
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
22 characteristics
Executable
Application can handle large (>2GB) addresses
…

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Yes there is a tool, dumpbin will do this.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@siemens.com” wrote in
message news:xxxxx@ntdev:

> Hi,
>
> I have several sys files (driver files).
>
> Some off them are for 64 Bit and some of them for 32 Bit.
>
>
>
> I have two abc.sys files but I do not know which one is for 32 Bit and which one is for 64 Bit.
>
>
>
> How can I figure that out?
>
> I guess inside those files is something like a header with meta data. I guess there is also a flag in those meta data that say 32 or 64 Bit. Is there a tool that can check binaries *.sys, *.exe … And that can tell me for which cpu architecture such a file was build?
>
>
>
>
>
> Thanks in advance for all help full answers.

4

Don Burn wrote:

Yes there is a tool, dumpbin will do this.

Tim Roberts wrote:

C:\tmp> link /dump /headers drv\32\vidousb.sys

Yes. Dumpbin is a shortcut for “link /dump”, just as editbin is a
shortcut for “link /edit” and lib is a shortcut for “link /lib”. I
cannot explain why I insist on using the longer form. It is an annoying
personality quirk.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

ok, it works :=)

Thanks for that fast an helpfull answers !