Windows – find binary files in windows

file managementwindows

Is there any way to search for executable files in windows when it has been renamed? Say a .exe file has been renamed to a .txt or a .jpeg extension.

Best Answer

You can use the Unix file utility, which can tell you what a file is based on its contents. You will need either the Cygwin environment or a win32-port package like GnuWin32 or UnxUtils.

Here's how file works:

# previously, e.exe was renamed to e.jpg
$ file e.jpg
e.jpg: MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit

Obviously, you have to give file a filename (or list of filenames) as an argument(s). You could do this with find if you know roughly where the file should be, by using find and a folder name:

$ find <foldername> -type f -print0 | xargs -0 file

If you combine this with grep, you can strip out the non-executables:

$ find e-0.02718 -type f -print0 | xargs -0 file | grep executable
e-0.02718/e.jpg:          MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit
e-0.02718/e.linux:        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.0.0, dynamically linked (uses shared libs), stripped
e-0.02718/e.sun4u56:      ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked (uses shared libs), stripped
e-0.02718/EXAMPLES:       Bourne shell script text executable
e-0.02718/makefile:       script text executable for make -f

Cygwin and GnuWin32 both provide the file and find commands (via the file and findutils packages).

UnxUtils includes find, but I can't verify that the file command is included. The package does not appear to be maintained, so GnuWin32 is probably a better option.

Related Question