Identifying an EXE file’s PE type via PowerShell

Preamble

I am trying to ascertain the platform-type of an EXE and I cannot reconcile what I’m seeing with any known source.

I have a bit of PowerShell which reads the first 30 characters of an EXE as text, splits on the characters ‘PE’, and then gets the next two characters after it.
I then convert those characters into UTF-16 bytes, the output of which I check against a lookup table to ascertain the platform of the executable.
This gives me the following list:

Platform Text Hex UTF-16
x86 L 4C 01 4C 1
x86-64 d† 64 86 64 2020
AA64 64 AA 64 AA

All well and good so far; however, a recent error report received from a user reads thus:

Error! Unhandled input: 64 15E

Looking up 15E I receive the Ş character, which nothing I look up online wants anything to do with. I am having immense difficulty trying to reconcile this with any known PE signature and I want to say “the file must just be corrupt”, but I wanted to check in here and make sure I wasn’t missing anything.

Question

What does 15E (Ş) translate to in a PE signature, if anything at all?

Preëmpting reader questions

  • Why are you using PowerShell and not xyz?
    • Because I have to. I cannot use any third-party tools to accomplish this, I can only use binaries we can assume to be installed on a standard Windows system. Otherwise I’d use EXIFTool or something. For similar reasons, my code must be PowerShell 2.0-compliant.
  • You shouldn’t be reading the input as text
    • Perhaps not, but this method works and it allows me to use get-content to only pull the first 30 characters without mountains of code. Doing the same thing using (say) a stream reader and only pulling the first 30 bytes is a huge effort.
  • Instead of pulling the first x characters and splitting on PE you should be looking at specific locations for the PE header
    • The location of the PE header is inconsistent across platforms (and even across executables), which is not great when the whole point of the code is to ascertain what the platform type is.

The Function

function getPEArch ($fileInput) { #build 4/seagull april 2025
    $arrHex=$()
    (((($(get-content "$fileInput" -TotalCount 30) -as [string]) -split 'PE')[1]).substring(2,2)).ToCharArray() | % {
        $arrHex+="$([System.String]::Format("{0:X}", [System.Convert]::ToUInt32($_))) "
    }

    switch ($arrHex.trim()) {
        "4C 1" {
            return "x86"
        } "64 2020" {
            return "x86-64"
        } "64 AA" {
            return "Arm64"
        } default {
            return "! ERROR: Unhandled input $($_)"
        }
    }
}