Is there a windows command that returns the list of 64 and 32 process?

Question

I am looking for a solution to locate which process are running over 64 and which ones on 32 bits on my Windows Seven 64 system, there is a simple windows shell command available to do that???

Solution 1

After some thought, I realized the WMIC method is kind of hokey. A much better way to do this is to use a PowerShell script that looks something like this:

[System.Diagnostics.Process[]] $processes64bit = @()
[System.Diagnostics.Process[]] $processes32bit = @()

foreach($process in get-process) {
    $modules = $process.modules
    foreach($module in $modules) {
        $file = [System.IO.Path]::GetFileName($module.FileName).ToLower()
        if($file -eq "wow64.dll") {
            $processes32bit += $process
            break
        }
    }

    if(!($processes32bit -contains $process)) {
        $processes64bit += $process
    }
}

write-host "32-bit Processes:"
$processes32bit | sort-object Name | format-table Name, Id -auto

write-host ""
write-host "64-bit Processes:"
$processes64bit | sort-object Name | format-table Name, Id -auto

If you copy that in to a PowerShell script, call it process-width.ps1, and run it in PowerShell, it will list out all the 32-bit processes followed by the 64-bit processes.

It does this by checking if a process has wow64.dll loaded as a module in to it's process space. wow64.dll is the Windows 32-bit emulation layer for 64-bit operating systems. It will only be loaded by 32-bit processes, so checking for it is a sure-fire way to know if a process is 32-bit or not.

This should work much better as a long term solution.

Solution 2

If you have Visual Studio installed, then you can simply use dumpbin.exe from the Visual Studio Command Prompt to dump the executable headers:

dumpbin.exe /HEADERS file.exe

The machine header will be 14C for an x86 binary and 8664 for x64:

x86:

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
         14C machine (x86)

x64

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
        8664 machine (x64)

Solution 3

wmic process get

Will list out all the processes on the system. You can pass parameters to get which are WMI Win32_Process properties. You can find that list here:

http://msdn.microsoft.com/en-us/library/aa394372(v=vs.85).aspx

One of those may show whether the process is 64 or 32-bit.

e: There isn't a direct property, but you can do:

wmic process get Name, MaximumWorkingSetSize

If the number returned by MaximumWorkingSetSize is greater than 3096, then it's definitely a 64-bit process. On my machine, 64-bit processes will have a MaximumWorkingSetSize of 32768 (aka 32gb), while 32-bit processes will have a MaximumWorkingSetSize of 1380, which is the adjusted size of my swap file. At any rate, the simple check is:

MaximumWorkingSetSize > 3096 == 64-bit

Solution 4

It's easy, just fire Task Manager. The process with *32 is 32 bit app

View more solutions

Comments

[Diogo]

hmmm something is not working, i used wmic process get > file.txt and found for all entries on it, but on my 64 system it says that I have only 32 processes running.

[Matt Holmes]

Did you run "wmic process get Name, MaximumWorkingSetSize > file.txt"? If any of those have a MaxiumumWorkingSetSize > 3096, they are 64-bit processes. Also make sure you run as an administrator account so you see all the processes not just yours.

[Diogo]

Sure, i did it now and it worked, but im still getting a strange result, only dwm.exe and ccSvcHst.exe got more than 1380 score, i was thinking that most of the running process was 64 bits.

[Diogo]

However it really helped me, thank you very much Matt.

[Rhys]

Cool, nice trick.

[Matt Holmes]

Actually you will find that a majority of the processes on a 64-bit machine will be 32-bit. While our CPU's, operating systems and emulation layers are light years ahead of where they were five years ago, most software is still 32-bit. We're getting there though :)

[Matt Holmes]

I think he very clearly wanted this as a shell script, or something he could run and parse the output of.

[Phil]

A more succinct way to get all 32-bit processes: Get-Process | where { ($_.Modules | where { $_.FileName -match "\\wow64.dll$" }) }