How to determine the target machine from a DLL? - dll

Question

How can I determine the machine on which a given DLL can run. There are many platforms ARM, SH4, x64, x32. When I have no other information than the DLL itself how to do that?
Background: There is a set off DLLs and some of them are not appropriate. How to detect them "offline"?
SOLUTION
Thanks for the help: the solution I use is the perl script
#!/usr/bin/perl
#
# usage: DllVer <exefile>
#
use strict;
use warnings;
use diagnostics;
my $exe = $ARGV[0];
my $doshdr; my $pehdr;
my %machines = (
0x014c => "I386",
0x0162 => "R3000",
0x0166 => "R4000",
0x0168 => "R10000",
0x0169 => "WCEMIPSV2",
0x0184 => "ALPHA",
0x01a2 => "SH3",
0x01a3 => "SH3DSP",
0x01a4 => "SH3E",
0x01a6 => "SH4",
0x01c0 => "ARM",
0x01c2 => "THUMB",
0x01d3 => "AM33",
0x01f0 => "POWERPC",
0x01f1 => "POWERPCFP",
0x0200 => "IA64",
0x0266 => "MIPS16",
0x0284 => "ALPHA64",
0x0366 => "MIPSFPU",
0x0466 => "MIPSFPU16",
0x0520 => "TRICORE",
0x8664 => "AMD64",
0x9041 => "M32R",
);
open(EXE, $exe) or die "can't open $exe: $!";
binmode(EXE);
if (read(EXE, $doshdr, 68)) {
my ($magic,$skip,$offset)=unpack('a2a58l', $doshdr);
die("Not an executable") if ($magic ne 'MZ');
seek(EXE, $offset, 0);
if (read(EXE, $pehdr, 6)){
my ($sig,$skip,$machine)=unpack('a2a2v', $pehdr);
die("No a PE Executable") if ($sig ne 'PE');
if (exists $machines{$machine}) {
print $machines{$machine} . "\n";
}
else{
printf("Unknown machine type 0x%lx\n", $machine);
}
}
}
close(EXE);

Answer 1

Try this perl script:
#!/usr/bin/perl
#
# usage: DllVer <exefile>
#
$exe = $ARGV[0];
open(EXE, $exe) or die "can't open $exe: $!";
binmode(EXE);
if (read(EXE, $doshdr, 68)) {
($magic,$skip,$offset)=unpack('a2a58l', $doshdr);
die("Not an executable") if ($magic ne 'MZ');
seek(EXE,$offset,SEEK_SET);
if (read(EXE, $pehdr, 6)){
($sig,$skip,$machine)=unpack('a2a2v', $pehdr);
die("No a PE Executable") if ($sig ne 'PE');
if ($machine == 0x014c){
print "i386\n";
}
elsif ($machine == 0x0200){
print "IA64\n";
}
elsif ($machine == 0x8664){
print "AMD64\n";
}
else{
printf("Unknown machine type 0x%lx\n", $machine);
}
}
}
close(EXE);

Answer 2

One way is to use the dumpbin utility:
C:\Windows\System32>dumpbin /headers kernel32.dll
Microsoft (R) COFF/PE Dumper Version 9.00.30729.01
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file kernel32.dll
PE signature found
File Type: DLL
FILE HEADER VALUES
14C machine (x86)
4 number of sections
49E037DD time date stamp Sat Apr 11 08:25:33 2009
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
2102 characteristics
Executable
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic # (PE32)
8.00 linker version
... etc ...