How do I determine the architecture of an executable binary on Windows 10

Question

Given some Random.exe on Windows, how can I determine

1. its CPU architecture eg Intel/ARM, and
2. its bitness eg 32 or 64.

Is there a property in File Explorer, some other tool, or programatic method I can use?

Answer 1

The architecture of the executable is written in the Machine field of the COFF header. You can retrieve it programatically or manually with a hex editor:

• Go to offset 0x3C in the file. The four bytes there hold the offset of the COFF header (from the beginning of the file).
• Go to the COFF header pointed by the above field, and advance by four (4) bytes.
• The following two (2) bytes are the Machine field.

You can see PE structure here. The valid Machine field values are listed here.

EDIT: Here's a C code that does that, untested:

int main(int argc, char *argv[]) {
    FILE *f = fopen(argv[1], "rb");
    uint32_t offset = 0;
    fseek(f, 0x3c, SEEK_SET);
    fread(&offset, sizeof(offset), 1, f);
    fseek(f, offset + 4, SEEK_SET);
    uint16_t machine = 0;
    fread(&machine, sizeof(machine), 1, f);
    printf("Machine: 0x%.4x\n", machine);
}