When I scan few executables in my windows directory with ProtectionID, I happened to scan Windows Explorer. And the results are given below.
Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.548 Second(s)
I know that my processor is Core 2 Duo and it's x64 architecture as resulted in warning flag. But the OS I've installed is Windows 7 x64. The above results raise me a question that my OS is x64 or IA64? How can I find that?
Update In the latest build of ProtectionID this false warning seems fixed.
The CPU type should be in the environment variable %PROCESSOR_ARCHITECTURE%
, and echo %PROCESSOR_ARCHITECTURE%
in the command prompt should give you AMD64
on a x86-64 processor. msinfo32.exe should also have a "System Type" field, which says x64-based PC for me on a x86-64 processor. I'm not sure how/why you have a IA64 system binary...
It seems to be a problem with ProtectionID:
Scanning -> C:\Windows\explorer.exe
File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 2871808 (02BD200h) Byte(s)
[!] Warning : Cpu is AMD, this file is for IA64 (incompatible)
[x] Warning - FileAlignment seems wrong.. no solution calculated (using NULL)
[File Heuristics] -> Flag : 00000000000001001101000000000000 (0x0004D000)
[CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.828 Second(s)
But in the PE Stuff tab:
As the first comment on the Q notes, there is no IA64 build of Windows 7. For an IA64 version you must use server.
Perhaps the most reliable way to determine this information is with WMI and the classes Win32_OperatingSystem and Win32_ComputerSystem.
Using PowerShell and the gwmi
alias for Get-WmiObject
:
PS> gwmi win32_computersystem -computer one,two,localhost| ft __SERVER,systemtype __SERVER systemtype -------- ---------- ONE X86-based PC TWO x64-based PC THREE x64-based PC
so One isn't 64bit, and the other two are both x64, none are IA64.1 Then:
PS [64] E:\ #12> gwmi win32_operatingsystem -comp one,two,localhost| ft __SERVER,caption __SERVER caption -------- ------- ONE Microsoft® Windows Server® 2008 Standard TWO Microsoft Windows Server 2008 R2 Standard THREE Microsoft Windows 7 Ultimate
So One is Win2k8 32bit, Two is Win2k8R2 64bit and Three (localhost) is Win7 64bit.
1 I don't have an IA64 system to check what value the SystemType
field will have.
The IA64 architecture is completely different from the x86-64 (aka AMD64) architecture, which is what most people mean when they say 64-bit. So even if there was a IA64-compatible version of Windows 7 (which, as other people have pointed out, there isn't1), it would require an Itanium processor, you wouldn't be able to install it on a Core 2 Duo or any other x86-64 system.
Edit: also, an alternative way to get the processor architecture with WMI (from command prompt or PS):
wmic CPU get Architecture
CPU
is an alias for the Win32_Processor class, and the possible values2 are (meanings in parentheses):
0
(x86)9
(x86-64)6
(Itanium)1 The last client version to support IA64 was Windows XP; Windows Server 2008 R2 will be the last server version.
2 There's a few others, for architectures like MIPS, Alpha and PowerPC, but those are mostly there for legacy reasons; see the MSDN article above for full details.
Open a Command window and run the following:
C:\>set | findstr ARCH
PROCESSOR_ARCHITECTURE=x86
User contributions licensed under CC BY-SA 3.0