2016-09-14 91 views

回答

2

PowerShell有很多先進的PE header解析器。

這裏有一個簡單的函數,只需讀取Machine Type領域:

function Is64bit([string]$path) { 
    try { 
     $stream = [IO.File]::OpenRead($path) 
    } catch { 
     throw "Cannot open file $path" 
    } 
    $reader = [IO.BinaryReader]$stream 

    if ($reader.ReadChars(2) -join '' -ne 'MZ') { throw 'Not an executable' } 

    $stream.position = 0x3C 
    $stream.position = $reader.ReadUInt32() # go to COFF 
    if ($reader.ReadUInt32() -ne 0x00004550) { throw 'Not a PE executable' } 

    return $reader.ReadUInt16() -eq 0x8664 # machine type 
} 

用法:

Is64bit C:\Windows\explorer.exe 
相關問題