<code> function Test-IsFile64Bit { <# .SYNOPSIS Determines the Bitness of a file EXE .DESCRIPTION Returns the following: FilePath FileType Is64Bit -------- -------- ------- C:\Windows\notepad.exe x64 True or FilePath FileType Is64Bit -------- -------- ------- C:\Windows\SysWOW64\cmd.exe x86 False .PARAMETER Path Path of the file to copy. .EXAMPLE Test-IsFile64Bit -Path "C:\Windows\explorer.exe" .EXAMPLE $(Test-IsFile64Bit -Path "C:\Windows\SysWOW64\cmd.exe").Is64Bit (Returns $true or $false) .NOTES .LINK Based on: https://superuser.com/questions/358434/how-to-check-if-a-binary-is-32-or-64-bit-on-windows By "megamorf" #> [CmdletBinding()] param( [Parameter(Mandatory=$true)] [ValidateNotNullorEmpty()] [string]$Path = "$env:windir\notepad.exe" ) [int32]$MACHINE_OFFSET = 4 [int32]$PE_POINTER_OFFSET = 60 [byte[]]$data = New-Object -TypeName System.Byte[] -ArgumentList 4096 $stream = New-Object -TypeName System.IO.FileStream -ArgumentList ($Path, ‘Open’, ‘Read’) $stream.Read($data, 0, 4096) | Out-Null [int32]$PE_HEADER_ADDR = [System.BitConverter]::ToInt32($data, $PE_POINTER_OFFSET) [int32]$machineUint = [System.BitConverter]::ToUInt16($data, $PE_HEADER_ADDR + $MACHINE_OFFSET) $result = "" | select FilePath, FileType, Is64Bit $result.FilePath = $Path $result.Is64Bit = $false switch ($machineUint) { 0 { $result.FileType = ‘Native’ } 0x014c { $result.FileType = 'x86' } 0x0200 { $result.FileType = 'Itanium' } 0x8664 { $result.FileType = 'x64'; $result.is64Bit = $true; } } $result } $(Test-IsFile64Bit "C:\Windows\SysWOW64\cmd.exe").Is64Bit #Test-IsFile64Bit "C:\Program Files (x86)\McAfee\Common Framework\cmdagent.exe"</code>
Just FYI, the toolkit also has a function called Get-PEFileArchitecture that will return this information.
Thanks for the tip @Muhammad. Where is this function documented? I wouldn’t have known about it if not for your comment.