I found several ways to define the bitness of PE.
IMAGE_FILE_HEADERcontains the/a (how do you choose an article type in such place?) field
Characteristicsthat could be checked for
IMAGE_OPTIONAL_HEADERcontains the field
IMAGE_FILE_HEADERalso contains Machine field that could be checked for
- 0x8664 - x64
- 0xaa64 - ARMv8 in 64-bit mode
- 0x0200 - Intel Itanium processor family
- 0x0284 - 64-bit Alpha AXP.
IMAGE_FILE_HEADERcould be checked for one of two specific values.
Are all of them have the same meaning? Are there any difference, specific conditions, exceptional cases?
I found that
Machine field check is indirect way because the field is aimed to processor architecture defining. So it's indirect and unreliable as heuristic.
SizeOfOptionalHeader varies even for the same bitness since some image directories can absent.