powershell check pe type (x86/x64/arm64)

petype.ps

function Get-ExeArchitecture {
    param([string]$Path)
    
    $bytes = [System.IO.File]::ReadAllBytes($Path)
    
    # 检查 PE 头标志
    $machineType = [System.BitConverter]::ToUInt16($bytes, [System.BitConverter]::ToUInt16($bytes, 0x3C) + 4)
    
    switch ($machineType) {
        0x014c { "x86 (32位)" }
        0x0200 { "IA64 (已过时)" }
        0x8664 { "x64 (64位)" }
        0xaa64 { "ARM64" }
        0x01c0 { "ARM (32位)" }
        0x01c4 { "ARM (Thumb)" }
        default { "未知架构: 0x{0:x4}" -f $machineType }
    }
}

# 使用示例
Get-ExeArchitecture -Path "C:\Windows\System32\notepad.exe"