3

I found several ways to define the bitness of PE.

  • IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for IMAGE_FILE_32BIT_MACHINE.
  • IMAGE_OPTIONAL_HEADER contains the field Magic switched between IMAGE_NT_OPTIONAL_HDR32_MAGIC, IMAGE_NT_OPTIONAL_HDR64_MAGIC and some IMAGE_ROM_OPTIONAL_HDR_MAGIC.
  • IMAGE_FILE_HEADER also contains Machine field that could be checked for
    • 0x8664 - x64
    • 0xaa64 - ARMv8 in 64-bit mode
    • 0x0200 - Intel Itanium processor family
    • 0x0284 - 64-bit Alpha AXP.
  • Also SizeOfOptionalHeader in IMAGE_FILE_HEADER could be checked for one of two specific values.

Are all of them have the same meaning? Are there any difference, specific conditions, exceptional cases?


I found that Machine field check is indirect way because the field is aimed to processor architecture defining. So it's indirect and unreliable as heuristic. SizeOfOptionalHeader varies even for the same bitness since some image directories can absent.

  • Is there any reason you can't just check for 64 bit registers in the decomp? – baordog Feb 12 '15 at 16:10
  • I look for truth. And I need fast and reliable way for automatic files processing. – SerG Feb 12 '15 at 19:30
2

IMAGE_OPTIONAL_HEADER->MAGIC (which is not optional at all :] ) is what determines for the Windows OS Loader to load this as 32bit vs 64bit. Depending on the value at IMAGE_OPTIONAL_HEADER->MAGIC is how the loader will parse the rest of the IMAGE_OPTIONAL_HEADER.

And as stated SizeOfOptionalHeader can be use as a cross reference.

The IMAGE_FILE_HEADER->MAGIC is used to determine the intended CPU. Mainly use to determine how machine code should be interpret.

  • As Magic is already located inside optional header structure, it's likely bitness is defined before memory after IMAGE_FILE_HEADER will be "mapped" to 32 or 64 -bit kind of optional header struct. – SerG Feb 12 '15 at 21:36
0

The Machine field will tell you the target platform, which includes its bitness, and the endianness of the section contents. The PE header itself is little-endian (and the optional header is entirely optional for object files).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.