Search code examples
windbgcrash-dumpssos

Determine if process dump was generated on x64 or x86 machine

If I have a process dump file, is there anyway of knowing if the dump was generated on a x64 machine or x86 machines?

Solution

  • You can look at the environment variables. Output of command !peb, among other things, contains list of environment variables. If you see variables PROCESSOR_ARCHITEW6432 or ProgramW6432 defined, the OS is 64 bit. Otherwise, it is 32 bit.