My original code would fail to detect a 16 bit PE as you correctly pointed out in one of your previous post.
just FYI, there is no such thing as a 16bit PE.
twain.dll is 16bit but, it is not a PE file. It is an NE file.
Also,
In a PE file, the first DWORD of the IMAGE_NT_HEADERS is "PE00" (in string form - $00004550 in binary form). In an NE file, at the same location, there is a WORD (not a dword) with the signature "NE". See attached screenshot for a "dump" of twain.dll's header.
It's "risky" to conclude the DLL is 16 bit without checking that its signature is "NE".
It would probably be wise too to ensure that
PINTH := PImageNtHeaders(PAnsiChar(PMapView) + PIDH^._lfanew);
is readable before dereferencing it just in case the dll is corrupted. The same applies to PIDH (after all, if the dll is corrupted, it could have a file size of zero.)
The magic value "IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107" is known/valid. For that value the code will return pebUnknown, which is reasonable since it is quite unlikely that an application would want to load such a file but, strictly speaking, it is not "unknown".
The above comments are on sale for $0.02
ETA:@Serge:
Do you know why the result is different for
c:\Windows\Sysnative\netmsg.dll ? the 64bit version says "unknown" and the 32bit version says 64 bit. Do you know if Windows is playing some kind of trick on 32bit executables when they look at files in the Sysnative directory or is there some other reason for the difference ?