PE trick explained: Telling 32 and 64 bit apart with the naked eye

▤ Summary

Now we know how it works and what it means, but is it a reliable way to determine the bitness of a PE file? While working on my thesis about Portable Executable anomalies, I discovered that the PE COFF specification is often more strict than the values Windows actually allows. Windows is very fault-tolerant with files that violate the specification because it needs to be backwards compatible. However, if you put this to the test and change the value of the machine field, you will see that the file cannot be executed anymore. That means, yes, this trick is reliable, just not encompassing all PE files.

▦ Linked Companies

GitHub, Inc.

$1M to $5M