Warning

The given file is mapped in memory using CreateFileMapping with PAGE_READONLY and SEC_IMAGE_NO_EXECUTE.
While risks are very low, you should be careful when handling untrusted executables and known malware.

Usage

PEArch.exe [/?] [/E|/AsError] [/H|/AsHex] [/F|/FullText] <File>

Options:
  /?             Prints this help text, and some additional details.
  /E, /AsError   Gives out the result as an error code.
  /H, /AsHex     Prints the architecture as a hex number.
  /F, /FullText  Prints a longer description of the architecture.

Click here to show/hide the architecture and return codes

STDOUT	STDOUT with /AsHex	STDERR with /AsError	Description (Source: MSDN)
UNKNOWN	0x0	0	The content of this field is assumed to be applicable to any machine type
ALPHA	0x184	388	Alpha AXP, 32-bit address space
ALPHA64	0x284	644	Alpha 64, 64-bit address space
AM33	0x1d3	467	Matsushita AM33
AMD64	0x8664	34404	x64
ARM	0x1c0	448	ARM little endian
ARM64	0xaa64	43620	ARM64 little endian
ARM64EC	0xA641	42561	ABI that enables interoperability between native ARM64 and emulated x64 code.
ARM64X	0xA64E	42574	Binary format that allows both native ARM64 and ARM64EC code to coexist in the same file.
ARMNT	0x1c4	452	ARM Thumb-2 little endian
AXP64	0x284	644	AXP 64 (Same as Alpha 64)
EBC	0xebc	3772	EFI byte code
I386	0x14c	332	Intel 386 or later processors and compatible processors
IA64	0x200	512	Intel Itanium processor family
LOONGARCH32	0x6232	25138	LoongArch 32-bit processor family
LOONGARCH64	0x6264	25188	LoongArch 64-bit processor family
M32R	0x9041	36929	Mitsubishi M32R little endian
MIPS16	0x266	614	MIPS16
MIPSFPU	0x366	870	MIPS with FPU
MIPSFPU16	0x466	1126	MIPS16 with FPU
POWERPC	0x1f0	496	Power PC little endian
POWERPCFP	0x1f1	497	Power PC with floating point support
R3000BE	0x160	352	MIPS I compatible 32-bit big endian
R3000	0x162	354	MIPS I compatible 32-bit little endian
R4000	0x166	358	MIPS III compatible 64-bit little endian
R10000	0x168	360	MIPS IV compatible 64-bit little endian
RISCV32	0x5032	20530	RISC-V 32-bit address space
RISCV64	0x5064	20580	RISC-V 64-bit address space
RISCV128	0x5128	20776	RISC-V 128-bit address space
SH3	0x1a2	418	Hitachi SH3
SH3DSP	0x1a3	419	Hitachi SH3 DSP
SH4	0x1a6	422	Hitachi SH4
SH5	0x1a8	424	Hitachi SH5
THUMB	0x1c2	450	Thumb
WCEMIPSV2	0x169	361	MIPS little-endian WCE v2v2

Output examples

Without options:

Command: pearch "C:\Windows\explorer.exe"
> STDOUT: AMD64
> STDERR:
> ERRORLEVEL: 0

Command: pearch "C:\Windows\non-existant-file.exe"
> STDOUT:
> STDERR: Cannot open file !
> ERRORLEVEL: 12

With /AsHex and /AsError:

Command: pearch /AsHex "C:\Windows\explorer.exe"
> STDOUT: 8664
> STDERR:
> ERRORLEVEL: 0

Command: pearch /AsError "C:\Windows\explorer.exe"
> STDOUT:
> STDERR:
> ERRORLEVEL: 34404

Command: pearch /AsError /AsHex "C:\Windows\explorer.exe"
> STDOUT: 8664
> STDERR:
> ERRORLEVEL: 34404

Command: pearch /AsError /AsHex "C:\Windows\non-existant-file.exe"
> STDOUT:
> STDERR: Cannot open file !
> ERRORLEVEL: 0

Cloning

Use this command to clone the repository and its submodules:

git clone --recurse-submodules https://github.com/aziascreations/PEArch.git

If you forgot the submodules, use this command:

git submodule update --init --recursive

License

All the code in this repo is released in the Public Domain.