python 判断dll是32位还是64位
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了python 判断dll是32位还是64位相关的知识，希望对你有一定的参考价值。
#_*_coding:gb2312_*_########################
#Writer:Write by lhsbqb#
#Date:2012-07-16 #
########################
import sys
class GetDllBit:
def __init__(self, dll_name=""):
if len(sys.argv) == 2: #获取DLL软件名
#print sys.argv[1].decode('gb2312')
self.dll_name = sys.argv[1]
self.Oper()
elif dll_name:
self.dll_name = dll_name
self.Oper()
else:
print "Error, Please input only one dll file name."
def Oper(self): #总操作 获取pe标志 找到pe入口
f = open(self.dll_name, "rb").read(80)
s1 = f[60:61] #低位
s2 = f[61:62] #高位
self.CheckDll(self.Convert(hex(ord(s1))),self.Convert_H(hex(ord(s2))))
def CheckDll(self, one, two): #判断DLL是多少位
res_num = int(one) + int(two) + 6
f = open(self.dll_name, "rb").read(res_num)
for c in f[res_num-2:res_num-1]:
#print("f[res_num-2:res_num-1]",hex(ord(c)))
s_1 = hex(ord(c))
for c in f[res_num-1:res_num]:
#print("f[res_num-1:res_num]",hex(ord(c)))
s_2 = hex(ord(c))
if s_1 == "0x4c" and s_2 == "0x1":
print("This program run in 32bit system!")
elif s_1 == "0x64" and s_2 == "0x86":
print("This program run in 64bit system!")
else:
print("Error!"+s_1+s_2)
#print("res_num",res_num)
def Convert(self, ss): #低位 进行编码转换
if len(ss) == 3:
if ss[-1] == "a" or ss[-1] == "A":
ss = 10
elif ss[-1] == "b" or ss[-1] == "B":
ss = 11
elif ss[-1] == "c" or ss[-1] == "C":
ss = 12
elif ss[-1] == "d" or ss[-1] == "D":
ss = 13
elif ss[-1] == "e" or ss[-1] == "E":
ss = 14
elif ss[-1] == "f" or ss[-1] == "F":
ss = 15
else:
ss = int(ss[-1])
elif len(ss) == 4:
if ss[-1] == "a" or ss[-1] == "A":
ss1 = 10
elif ss[-1] == "b" or ss[-1] == "B":
ss1 = 11
elif ss[-1] == "c" or ss[-1] == "C":
ss1 = 12
elif ss[-1] == "d" or ss[-1] == "D":
ss1 = 13
elif ss[-1] == "e" or ss[-1] == "E":
ss1 = 14
elif ss[-1] == "f" or ss[-1] == "F":
ss1 = 15
else:
ss1 = int(ss[-1])
if ss[-2:-1] == "a" or ss[-2:-1] == "A":
ss2 = 10*16
elif ss[-2:-1] == "b" or ss[-2:-1] == "B":
ss2 = 11*16
elif ss[-2:-1] == "c" or ss[-2:-1] == "C":
ss2 = 12*16
elif ss[-2:-1] == "d" or ss[-2:-1] == "D":
ss2 = 13*16
elif ss[-2:-1] == "e" or ss[-2:-1] == "E":
ss2 = 14*16
elif ss[-2:-1] == "f" or ss[-2:-1] == "F":
ss2 = 15*16
else:
ss2 = int(ss[-2:-1])*16
ss = ss1 + ss2
return ss
def Convert_H(self, ss): #高位 进行编码转换
if len(ss) == 3:
if ss[-1] == "a" or ss[-1] == "A":
ss = 10*16*16
elif ss[-1] == "b" or ss[-1] == "B":
ss = 11*16*16
elif ss[-1] == "c" or ss[-1] == "C":
ss = 12*16*16
elif ss[-1] == "d" or ss[-1] == "D":
ss = 13*16*16
elif ss[-1] == "e" or ss[-1] == "E":
ss = 14*16*16
elif ss[-1] == "f" or ss[-1] == "F":
ss = 15*16*16
else:
ss = int(ss[-1])*16*16
elif len(ss) == 4:
if ss[-1] == "a" or ss[-1] == "A":
ss1 = 10*16*16
elif ss[-1] == "b" or ss[-1] == "B":
ss1 = 11*16*16
elif ss[-1] == "c" or ss[-1] == "C":
ss1 = 12*16*16
elif ss[-1] == "d" or ss[-1] == "D":
ss1 = 13*16*16
elif ss[-1] == "e" or ss[-1] == "E":
ss1 = 14*16*16
elif ss[-1] == "f" or ss[-1] == "F":
ss1 = 15*16*16
else:
ss1 = int(ss[-1])*16*16
if ss[-2:-1] == "a" or ss[-2:-1] == "A":
ss2 = 10*16*16*16
elif ss[-2:-1] == "b" or ss[-2:-1] == "B":
ss2 = 11*16*16*16
elif ss[-2:-1] == "c" or ss[-2:-1] == "C":
ss2 = 12*16*16*16
elif ss[-2:-1] == "d" or ss[-2:-1] == "D":
ss2 = 13*16*16*16
elif ss[-2:-1] == "e" or ss[-2:-1] == "E":
ss2 = 14*16*16*16
elif ss[-2:-1] == "f" or ss[-2:-1] == "F":
ss2 = 15*16*16*16
else:
ss2 = int(ss[-2:-1])*16*16*16
ss = ss1 + ss2
return ss
if __name__ == "__main__":
gdb = GetDllBit("32.dll") 参考技术A 方法一：Reflector
对于.Net dll文件，用Reflector工具可进行辨别：
其中的Platform Target就指明了该dll在编译时选择的目标系统。
方法二：CorFlags.exe工具
使用Vistual Studio.Net自带的corflags工具，先打开vs.net 命令窗口：
输入coreflags <assembly path>:
检查非托管 DLL 是 32 位还是 64 位？
【中文标题】检查非托管 DLL 是 32 位还是 64 位？【英文标题】：Check if unmanaged DLL is 32-bit or 64-bit? 【发布时间】：2010-11-03 08:06:08 【问题描述】：如何在 C# 中以编程方式判断 非托管 DLL 文件是 x86 还是 x64？
【问题讨论】：
查看堆栈溢出问题How to find if a native DLL file is compiled as x64 or x86?。 这能回答你的问题吗？ How to find if a native DLL file is compiled as x64 or x86? 【参考方案1】：我知道这已经有一段时间没有更新了。通过将文件加载到它自己的 AppDomain 中，我能够摆脱“错误图像格式”异常。
private static (string pkName, string imName) FindPEKind(string filename)
// some files, especially if loaded into memory
// can cause errors. Thus, load into their own appdomain
AppDomain tempDomain = AppDomain.CreateDomain(Guid.NewGuid().ToString());
PEWorkerClass remoteWorker =
(PEWorkerClass)tempDomain.CreateInstanceAndUnwrap(
typeof(PEWorkerClass).Assembly.FullName,
typeof(PEWorkerClass).FullName);
(string pkName, string imName) = remoteWorker.TryReflectionOnlyLoadFrom_GetManagedType(filename);
AppDomain.Unload(tempDomain);
return (pkName, imName);
此时，我执行以下操作：
public (string pkName, string imName) TryReflectionOnlyLoadFrom_GetManagedType(string fileName)
string pkName;
string imName;
try
Assembly assembly = Assembly.ReflectionOnlyLoadFrom(assemblyFile: fileName);
assembly.ManifestModule.GetPEKind(
peKind: out PortableExecutableKinds peKind,
machine: out ImageFileMachine imageFileMachine);
// Any CPU builds are reported as 32bit.
// 32bit builds will have more value for PortableExecutableKinds
if (peKind == PortableExecutableKinds.ILOnly && imageFileMachine == ImageFileMachine.I386)
pkName = "AnyCPU";
imName = "";
else
PortableExecutableKindsNames.TryGetValue(
key: peKind,
value: out pkName);
if (string.IsNullOrEmpty(value: pkName))
pkName = "*** ERROR ***";
ImageFileMachineNames.TryGetValue(
key: imageFileMachine,
value: out imName);
if (string.IsNullOrEmpty(value: pkName))
imName = "*** ERROR ***";
return (pkName, imName);
catch (Exception ex)
return (ExceptionHelper(ex), "");
对我的 Widows\Assembly 目录运行此程序可以让我在处理超过 3600 个文件时出现零错误。 注意：我使用字典来加载返回的值。
我希望它有所帮助。 YMMV
【讨论】：
【参考方案2】：更简单：查看 System.Reflection.Module 类。它包括 GetPEKind 方法，该方法返回 2 个描述代码类型和 CPU 目标的枚举。没有更多的十六进制！
（这篇内容丰富的帖子的其余部分无耻地从http://www.developersdex.com/vb/message.asp?p=2924&r=6413567复制）
示例代码：
Assembly assembly = Assembly.ReflectionOnlyLoadFrom(@"<assembly Path>");
PortableExecutableKinds kinds;
ImageFileMachine imgFileMachine;
assembly.ManifestModule.GetPEKind(out kinds, out imgFileMachine);
PortableExecutableKinds 可以用来检查什么样的程序集。它 有 5 个值：
ILOnly：可执行文件仅包含 Microsoft 中间语言 (MSIL)，因此对于 32 位或 64 位是中性的 平台。
NotAPortableExecutableImage：文件不在可移植可执行文件 (PE) 中 文件格式。
PE32Plus：可执行文件需要 64 位平台。
Required32Bit：可执行文件可以在 32 位平台上运行，或者在 64 位平台上的 32 位 Windows on Windows (WOW) 环境。
Unmanaged32Bit：可执行文件包含纯非托管代码。
以下是链接：
Module.GetPEKind 方法： http://msdn.microsoft.com/en-us/library/system.reflection.module.getpekind.aspx
PortableExecutableKinds 枚举： http://msdn.microsoft.com/en-us/library/system.reflection.portableexecutablekinds(VS.80).aspx
ImageFileMachine 枚举： http://msdn.microsoft.com/en-us/library/system.reflection.imagefilemachine.aspx
【讨论】：
这仅在您可以在进程中实际加载程序集时才有效。如果机器类型和位数不匹配，您将在 Assembly.LoadFile() 处收到“错误图像格式”异常，并且您将永远无法访问 GetPEKind()【参考方案3】：请参阅the specifications。这是一个基本的实现：
public static MachineType GetDllMachineType(string dllPath)
// See http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx
// Offset to PE header is always at 0x3C.
// The PE header starts with "PE\0\0" = 0x50 0x45 0x00 0x00,
// followed by a 2-byte machine type field (see the document above for the enum).
//
FileStream fs = new FileStream(dllPath, FileMode.Open, FileAccess.Read);
BinaryReader br = new BinaryReader(fs);
fs.Seek(0x3c, SeekOrigin.Begin);
Int32 peOffset = br.ReadInt32();
fs.Seek(peOffset, SeekOrigin.Begin);
UInt32 peHead = br.ReadUInt32();
if (peHead!=0x00004550) // "PE\0\0", little-endian
throw new Exception("Can't find PE header");
MachineType machineType = (MachineType) br.ReadUInt16();
br.Close();
fs.Close();
return machineType;
MachineType 枚举定义为：
public enum MachineType : ushort
IMAGE_FILE_MACHINE_UNKNOWN = 0x0,
IMAGE_FILE_MACHINE_AM33 = 0x1d3,
IMAGE_FILE_MACHINE_AMD64 = 0x8664,
IMAGE_FILE_MACHINE_ARM = 0x1c0,
IMAGE_FILE_MACHINE_EBC = 0xebc,
IMAGE_FILE_MACHINE_I386 = 0x14c,
IMAGE_FILE_MACHINE_IA64 = 0x200,
IMAGE_FILE_MACHINE_M32R = 0x9041,
IMAGE_FILE_MACHINE_MIPS16 = 0x266,
IMAGE_FILE_MACHINE_MIPSFPU = 0x366,
IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466,
IMAGE_FILE_MACHINE_POWERPC = 0x1f0,
IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1,
IMAGE_FILE_MACHINE_R4000 = 0x166,
IMAGE_FILE_MACHINE_SH3 = 0x1a2,
IMAGE_FILE_MACHINE_SH3DSP = 0x1a3,
IMAGE_FILE_MACHINE_SH4 = 0x1a6,
IMAGE_FILE_MACHINE_SH5 = 0x1a8,
IMAGE_FILE_MACHINE_THUMB = 0x1c2,
IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169,
我只需要其中三个，但为了完整起见，我将它们全部包含在内。最终 64 位检查：
// Returns true if the dll is 64-bit, false if 32-bit, and null if unknown
public static bool? UnmanagedDllIs64Bit(string dllPath)
switch (GetDllMachineType(dllPath))
case MachineType.IMAGE_FILE_MACHINE_AMD64:
case MachineType.IMAGE_FILE_MACHINE_IA64:
return true;
case MachineType.IMAGE_FILE_MACHINE_I386:
return false;
default:
return null;
【讨论】：
我将 FileAccess.Read 添加到您的 FileStream 实例化中 - 否则在尝试确定 C:\Windows 或 C:\Program Files 中 DLL 的位数时它会让我们大吃一惊 GetPEKind (msdn.microsoft.com/en-us/library/…) 在检查 32 位程序集时在 64 位进程中失败。您的代码是否适用？【参考方案4】：使用Assembly.ReflectionOnlyLoadFrom 代替Assembly.LoadFile。这将使您能够解决“错误的图像格式”异常。
【讨论】：
不幸的是，我在使用Assembly.ReflectionOnlyLoadFrom 时仍然收到System.BadImageFormatException。【参考方案5】：
使用 Visual Studio 命令提示符，dumpbin /headers dllname.dll 也可以工作。在我的机器上，输出的开头声明：
FILE HEADER VALUES
8664 machine (x64)
5 number of sections
47591774 time date stamp Fri Dec 07 03:50:44 2007
【讨论】：
以上是关于python 判断dll是32位还是64位的主要内容，如果未能解决你的问题，请参考以下文章
怎样判断一个exe可执行程序(dll文件)是32位的还是64位的