How to determine if a linux binary file is 32-bit or 64-bit?

Question

A 32-bit kernel (x86) can only run 32-bit code. A 64-bit kernel (x86_64) can run both 32-bit and 64-bit code.

I'd like to know if a machine can run an executable: in other words, I have a binary file and I have to run it on 32-bit Ubuntu, but I don't know if the binary file is 32-bit executable.

I used the file command, specifying the executable to be checked and this was the returned result:

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0x7329fa71323a6cd64823c2594338682065cd6e07, not stripped

Solution 1

The answer to the question in the title is right there at the beginning of the output:

ELF 64-bit LSB executable, x86-64

ELF is the Executable and Linkable Format, the binary executable file format most commonly used by Linux.

x86-64 is the architecture of the binary, the 64-bit version of the x86 instruction set originally introduced by AMD. For reasons that are beyond me, Microsoft refers to it as "x64", but that's the same thing.

If you need to know the architecture of the kernel itself, you can use uname -mpi. For example, on my system, that prints:

x86_64 unknown unknown

which means that I am running an x86-64 kernel.

If you're interested in the CPU itself, look at /proc/cpuinfo for details about the CPU(s) detected by the Linux kernel.

A 32-bit 80x86 executable is identified by file as, for example:

ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.8, stripped

which tells us that it's a 32-bit executable using the Intel 80386 instruction set (possibly with extensions).

Note that it isn't quite as simple as 32-bit versus 64-bit architectures. For example, the Linux kernel supports 32-bit architectures like Intel 80386, AVR32, S/390 and Unicore32. On the 64-bit side of things, Linux is usable on PA-RISC, x86-64, Itanium and Alpha, among others. Not all distributions provide binaries for all architectures, however (and I doubt there are any distributions that target all supported CPU architectures equally). So if you want to know whether a given binary will be executable on a given system, you need to consider the architecture, rather than the CPU's native word size.

Solution 2

The 5th byte of a Linux binary executable file (ELF format, see Wikipedia) is 1 for a 32 bit executable, 2 for a 64 bit executable.

To see this for a program named "foo", type at the command line

od -t x1 -t c foo | head -n 2

Solution 3

If you want to avoid the 'head' pipe, you can do

od -An -t x1 -j 4 -N 1 foo

This will print 01 if foo is a 32-bit binary and 02 if it's 64. It may still include some leading spaces - worth knowing if you're doing any automated comparisons on the results.

If found this useful in a basic Ubuntu Docker container where 'file' was not installed.

Comments

[Paul Draper]

"reasons that are beyond me". I still remember the day I found out that x64 was 64 bits and x86 was 32 bits.

[user]

@PaulDraper The term "x86" has a clear etymology; it dates back to the 80x86 series CPUs from Intel, differentiating them from their predecessors like the 8008 or 8080, and these days most often refers to the 32-bit (IA-32 instruction set) capable variants (80386, 80486, Pentium and newer). These more recent model numbers were often abbreviated by omitting the "80" at the beginning, so (implied 32-bit) x86 matches 386, 486, etc. However, I'm not aware of any 64-bit CPUs with model numbers of a similar structure ending in "64"; certainly neither AMD nor Intel use such a naming scheme today.

[Paul Draper]

Though x64 is a very common term. Random example: microsoft.com/en-us/download/details.aspx?id=42482

[user]

@PaulDraper It's common now in the Microsoft world, but its etymology remains unclear in a way that that for "x86" does not.

[phuclv]

Microsoft refers to x86_64 as AMD64 in their installers

[Andy]

@αCVn Intel uses IA64 to refer to Itanium, which was Intel's first 64 bit instruction set and was completely incompatible with 'legacy' x86 based processors. Intel really wanted this to be the 64 bit instruction set everybody used, so they went right ahead and called it Intel Architecture 64 bit, with deliberate emphasis on it being the only one. IA64 lost the 64 bit ISA war and is now deprecated, but you may still come across IA64 code. Intel calls modern 64 bit x86_64 because it is the 64 bit extension to the x86 instruction set invented by AMD. That is how we ended up with x86_64.

[MrMesees]

Is this just for x86?

[Xebozone]

Useful! Thanks for the answer!

[Xebozone]

Even more useful! Thanks!