47

When running CorFlags on some DLL file, some show as PE32 and some show as PE32+. What's the difference?

riQQ
  • 9,878
  • 7
  • 49
  • 66
user496949
  • 83,087
  • 147
  • 309
  • 426

3 Answers3

57

The PE32 format stands for Portable Executable 32-bit, while PE32+ is Portable Executable 64-bit format.

Please see this article for detailed info.

Matthias Braun
  • 32,039
  • 22
  • 142
  • 171
17

The flags interpretation:

Any CPU: PE = PE32 and 32BIT = 0

x86: PE = PE32 and 32BIT = 1

64-bit: PE = PE32+ and 32BIT = 0

Cornel Marian
  • 2,443
  • 23
  • 28
14

Here's a more complete list of architecture build options and the corresponding corflags output for the relevant fields:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
                      PE     32BITREQ  32BITPREF 
─────────────────────────────────────────────────
 x86                  PE32          1          0 
 AnyCPU               PE32          0          0 
 AnyCPU prefer 32bit  PE32          0          1 
 x64                  PE32+         0          0 
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Evgeniy Berezovsky
  • 18,571
  • 13
  • 82
  • 156