5

I have a collection of win32_process objects queried from a remote machine using WMI. How do I determine whether each process is 32-bit or 64-bit?

musaul
  • 2,341
  • 19
  • 26
  • 2
    Related: [How to determine whether a System.Diagnostics.Process is 32 or 64 bit?](http://stackoverflow.com/q/3575785/113116) – Helen Mar 09 '11 at 19:13

2 Answers2

1

WMI doesn't have this functionality. The solution is to test each process's Handle using IsWow64Process via P/Invoke. This code should help you get the idea.

Community
  • 1
  • 1
Helen
  • 87,344
  • 17
  • 243
  • 314
  • Thanks. I'll give that a go.Quite strange that they don't have a way of identifying that in the process class, or even in the .NET API for that matter. – musaul Mar 10 '11 at 13:51
0

Try this:

/// <summary>
/// Retrieves the platform information from the process architecture.
/// </summary>
/// <param name="path"></param>
/// <returns></returns>
public static string GetPlatform(string path)
{
    string result = "";
    try
    {
        const int pePointerOffset = 60;
        const int machineOffset = 4;
        var data = new byte[4096];
        using (Stream s = new FileStream(path, FileMode.Open, FileAccess.Read))
        {
            s.Read(data, 0, 4096);
        }
        // Dos header is 64 bytes, last element, long (4 bytes) is the address of 
        // the PE header
        int peHeaderAddr = BitConverter.ToInt32(data, pePointerOffset);
        int machineUint = BitConverter.ToUInt16(data, peHeaderAddr +
                                                      machineOffset);
        result = ((MachineType) machineUint).ToString();
    }
    catch { }

    return result;
}



public enum MachineType
{
    Native = 0,
    X86 = 0x014c,
    Amd64 = 0x0200,
    X64 = 0x8664
}
Xcalibur37
  • 2,305
  • 1
  • 17
  • 20
  • Keep in mind that this process is accurate but tends to be a bit heavy with enough processes in queue. I call this per process in another thread to alleviate the UI. – Xcalibur37 Dec 09 '11 at 21:03
  • You are writing this code in C#. A language whose EXEs can run either in 32-bit or 64-bit mode. You can't tell from the EXE header. – Hans Passant Dec 09 '11 at 22:08
  • You can compile to a specific platform. Otherwise, why have 2 different releases of the same executable? – Xcalibur37 Dec 10 '11 at 00:08
  • Why have two when you can have *one* that works on both platforms? AnyCPU is cool. – Hans Passant Dec 10 '11 at 00:19