Hello,
I've been using EXIFtool for a long time and today I decided to register in the forum to ask a question.
I often use EXIFtool to determine whether a programme is x86 or x64. Today I was doing some testing and I got a strange result when reading
Greenshot.exe (see programme on http://getgreenshot.org/downloads/).
According to the About section of programme, it's x64, and it's, in fact, installed in <Program Files> instead of <Program Files(x86)>. However, EXIFtool 10.53 says it's x86.
Thank you in advance for your help and congratulations on this great piece of software!
The MachineType in the PE COFF header indicates an Intel 386 or later, so ExifTool reports this as 32-bit. According to this post (https://superuser.com/questions/358434/how-to-check-if-a-binary-is-32-or-64-bit-on-windows), this should work. Perhaps try some of the other methods shown here (http://www.digitalcitizen.life/3-ways-learn-whether-windows-program-64-bit-or-32-bit) to see what they say.
- Phil
Hi, Phil,
Thank you very much for your quick answer and excuse me for my late response. I appreciate the information you've provided.
The advantage of using EXIFTool is that you don't need to run the application to know whether it's x86 or x64. If I understood well, the developer didn't write the correct information on the EXE file and that's why EXIFTool displays x86 instead of x64. I guess I could write to the developer to make them know.
David
Quote from: Phil Harvey on May 25, 2017, 07:33:25 AMPerhaps try some of the other methods shown here (http://www.digitalcitizen.life/3-ways-learn-whether-windows-program-64-bit-or-32-bit) to see what they say.
I downloaded the program mentioned and tested it with the methods mentioned in that link. Windows classifies the program as 64 bit. Exiftool 10.55 returns it as Win32 EXE.
Hello,
Thank you for your testing. I only wanted to say that Win32 (file type) corresponds to both x86 and x64 (machine type). EXIFTool shows "Win32 EXE" for file type and "Intel 386 or later, and compatibles" (x86) for machine type. I've double-checked and I'm using the 64-bit version of the programme.
I still want to look at this in more detail to see what is going on. It would be useful if you could send me Greenshot.exe for testing (your download link gives me an installer and I don't want to run the installer). Zipped would be best. My email is philharvey66 at gmail.com
- Phil
Hello, Phil,
Thank you: I've just sent you the file.
I got the file, thanks. I'll see what I can do to identify it properly, but this will take some work.
- Phil
Hi, Phil,
I was wondering if there's been any progress on this issue.
Thanks for your time!
Regards!
No progress yet, sorry. I did a bit of research so far but didn't find anything useful.
- Phil
Thanks anyway, Phil. :-)
This is still on my list to look into in more detail, but the time scale at this point is months since I am about to go on a 3 week vacation starting monday.
- Phil
Hello, Phil,
I hope you don't mind me asking if there are any updates about the issue. I suppose it's not a big deal for people using EXIF, but it would be nice to know that the detection of the x86 or x64 architecture is accurate.
Thank you for your time.
Regards,
David
Hi David,
Thanks for reminding me. I'll bump this up on my to-do list.
- Phil
Thank you, Phil!
I've been looking into this. This superuser.com topic (https://superuser.com/questions/358434/how-to-check-if-a-binary-is-32-or-64-bit-on-windows) addresses the same question. There are various techniques mentioned, but all of them that involve looking at the data in the file give the same answer as Exiftool because the PE32 header says the architecture is 386 (it isn't a PE32+ file). The Cygwin "file" command also gives this result:
> file ~/Desktop/Win64bit.exe
/home/phil/Desktop/Win64bit.exe: PE32 executable (GUI) Intel 80386 Mono/.NET assembly, for MS Windows
According to a post in the superuser topic linked above, it should say "x86-64" instead of "Intel 80386" for a 64-bit app.
So ExifTool is at least as unreliable as the "file" utility, but that isn't much consolation.
I'm at a bit of a loss. I can't find any documentation that provide any information about how to dig further into an EXE file to determine the architecture another way.
- Phil
Looking at this more, I found that my 64-bit sample has a "large address aware" flag set in the file header. There is also a "32-bit" flag that is not set. I'll test for this combination of flags, and call the file 64-bit if it matches. This update will appear in ExifTool 11.08
- Phil
Edit: I need to re-think this. I found a reference that says the "large address aware" flag is used for 32-bit applications to be able to use the top bit of the address space. So I can't use this to test for 64-bit apps.