It's not very exciting. It's not sexy. It's not even very flexible. All it does is show whether a binary file is 64-bit or 32-bit. That's it. But if you ever needed to locate/sort/verify or quickly view multiple files by their internal PE-Header architecture-type, then this is for you. Especially useful for searching, as it works in x2 and DeskRule alike.
This is a WDX "Content" Plugin; all you need is the x2 Plugin Manager (no installation required), and, of course, the plugin itself: Binary v0.0.0.1
Extract the archive, run the plugin manager, then drag-&-drop either the 64-bit (WDX64) or 32-bit (WDX) plugin into the window and click "Apply".
Once x2 has restarted, use <Alt+K> to enter the column selection dialog, and scroll to the bottom of the available columns list - there you'll find a new entry named "Architecture.Binary [X]" - just double-click it and you're done.
The plugin automatically creates a detection-string for EXE and DLL files, but you can add any other extensions you like which are Win-PE types such as OCX, CPL, and DRV (for example, even plugin extensions like 'WDX' are really just renamed DLL files). Please see the x2 Plugin Manager for more details about detection-strings.
Why did you create this thing?
Having a need to verify the architecture of DLL's system-wide, I couldn't find a means of searching through (and for) binaries by their compiled bit-types alone using any of the billions of system properties already available to the average dog-eared x2 user.
As it turns out, there isn't actually a property for this sort of thing, so instead of me running around urinating on every tree in the garden looking for just the right one in need of watering, I decided to plant my own.
If you look on the internet, there's all sorts of makeshift/workaround methods that people use for this - everything from doing blind searches for specific byte-sequences, to just loading them one by one into dedicated PE-Viewing utilities and looking at the details. Painful, often imprecise, awkward, and of absolutely no use to dogs with their heads in the wind.
All I really wanted was a simple method of searching for text like "32" or "64" in a property field, and the rest would fall into place. To achieve this, the proper method of byte-walking the image-headers to identify the machine-types (_I386 & _IA64/_AMD64) is somewhat complex, but that's what learning is all about (source-code is included, organised into a simple self-contained function which can be exported to other projects easily).
There is an alternate TC Plugin called ExeFormat which can supply similar information (and a bit more), but I wanted a smaller, dedicated, customisable solution. Take your pick.
Can the text be customised?
Sure, just open the Binary.ini file (automatically created wherever you placed the plugin itself), and edit the strings to your heart's content. A restart of x2/DeskRule will be required for changes to take effect.
Code: Select all
[Binary] ColumnName=Architecture Labels=<?>|x86 (32-Bit)|x64 (64-Bit)