$File = "C:\FaxCore\svc.renderagent\RenderAgent.exe" $fs = [System.IO.File]::OpenRead($File) $br = New-Object System.IO.BinaryReader($fs) try { # PE header location $fs.Position = 0x3C $peOffset = $br.ReadInt32() # Machine type $fs.Position = $peOffset + 4 $machine = $br.ReadUInt16() # Characteristics field $fs.Position = $peOffset + 4 + 18 $characteristics = $br.ReadUInt16() $largeAddressAware = ($characteristics -band 0x20) -ne 0 $architecture = switch ($machine) { 0x014c { "32-bit (x86)" } 0x8664 { "64-bit (x64)" } default { "Unknown (0x{0:X4})" -f $machine } } Write-Host "" Write-Host "File: $File" Write-Host "Architecture: $architecture" Write-Host "Large Address Aware: $largeAddressAware" Write-Host "" } finally { $br.Close() $fs.Close() }