I guess this still holds true today, I tried it and it works for ZoneAlarm.exe.
From: zdnet.com
All Windows programs, whether 16-bit or 32-bit, begin with an old-fashioned DOS executable header. The first 2 bytes of an executable, any DOS or Windows type, are still MZ, the initials of Mark Zbikowski (an early DOS programmer). A Windows 16-bit executable has a second "New Executable" header later in the file. The location of this second header is stored in the 60th and 61st bytes of the DOS header, and the first 2 bytes of the NE header are the characters NE. A Windows 32-bit executable also has a second header, at the same offset found in the DOS header, but this one's first 2 bytes are PE, for Portable Executable. Thus you could determine whether a file is 16-bit or 32-bit by painstakingly examining a few bytes in its second header. Fortunately, that's not necessary.
Under Windows 95 and Windows NT 4, a quick way to determine whether a program is 16-bit or 32-bit is to right-click the EXE file and choose QuickView. In the first block of data, titled Technical File Information, look for the line named Signature. If its value is 454e, the file is a 16-bit executable. If 4550, the file is 32-bit. Why? If you split that signature value into two two-digit hexadecimal numbers, reverse them, and convert them to ASCII characters, you get NE and PE respectively!
tc |
