To reliably determine the bitness of an executable image you'll need tool support. This can be as simple as a hex editor, to inspect the contents of the PE Image. You can determine the machine type of the binary by following these steps:
- Move to location 0x3c, and note the value of the 4 bytes there (little endian order). Those are the offset from the beginning of the file to the PE Signature.
- Move to the location noted in step 1, and verify, that the 4 bytes have the values
0x50
0x45
0x00
0x00
(PE\0\0
). That's the signature of a PE image. If the values are different, this is not an executable image.
- Move past the signature and note the next 2 bytes (little endian order). This value denotes the machine type of the binary image.
- Compare the value against the supported Machine Types:
0x014c
corresponds to x86 (32 bits).
0x8664
corresponds to x64 (64 bits).
While simple and reliable, it takes a certain amount of care. There are easier ways, using other tools. In case you have Visual Studio installed, you can use DUMPBIN to have it report the machine type by executing the following command at the command prompt:
dumpbin.exe /HEADERS <path\to\executable\image> | findstr machine
This will produce the following output (x86 and x64, respectively):
14C machine (x86)
or
8664 machine (x64)
If you don't have Visual Studio or don't want to install it, you could use Process Explorer to determine the bitness of a running process. To do so, right-click the respective process in the Process treeview, and select Properties.... On the Image tab you'll see the process' bitness spelled out.