EXE Tags
This module extracts information from various types of Windows, MacOS and
Unix executable and library files. The first table below lists information
extracted from the header of Windows PE (Portable Executable) EXE files and
DLL libraries.
| Index2 | Tag Name |
Writable | Values / Notes |
|---|
| 0 |
MachineType |
no |
0x14c = Intel 386 or later, and compatibles
0x14d = Intel i860
0x162 = MIPS R3000
0x166 = MIPS little endian (R4000)
0x168 = MIPS R10000
0x169 = MIPS little endian WCI v2
0x183 = Alpha AXP (old)
0x184 = Alpha AXP
0x1a2 = Hitachi SH3
0x1a3 = Hitachi SH3 DSP
0x1a6 = Hitachi SH4
0x1a8 = Hitachi SH5
0x1c0 = ARM little endian
0x1c2 = Thumb
0x1d3 = Matsushita AM33
0x1f0 = PowerPC little endian
0x1f1 = PowerPC with floating point support
0x200 = Intel IA64
0x266 = MIPS16
0x268 = Motorola 68000 series
0x284 = Alpha AXP 64-bit
0x366 = MIPS with FPU
0x466 = MIPS16 with FPU
0xebc = EFI Byte Code
0x8664 = AMD AMD64
0x9041 = Mitsubishi M32R little endian
0xc0ee = clr pure MSIL |
|
| 2 |
TimeStamp |
no |
|
| 9 |
ImageFileCharacteristics |
no |
Bit 0 = No relocs
Bit 1 = Executable
Bit 2 = No line numbers
Bit 3 = No symbols
Bit 4 = Aggressive working-set trim
Bit 5 = Large address aware
Bit 7 = Bytes reversed lo
Bit 8 = 32-bit
Bit 9 = No debug
Bit 10 = Removable run from swap
Bit 11 = Net run from swap
Bit 12 = System file
Bit 13 = DLL
Bit 14 = Uniprocessor only
Bit 15 = Bytes reversed hi |
|
| 10 |
PEType |
no |
0x107 = ROM Image
0x10b = PE32
0x20b = PE32+ |
| 11 |
LinkerVersion |
no |
|
| 12 |
CodeSize |
no |
|
| 14 |
InitializedDataSize |
no |
|
| 16 |
UninitializedDataSize |
no |
|
| 18 |
EntryPoint |
no |
|
| 30 |
OSVersion |
no |
|
| 32 |
ImageVersion |
no |
|
| 34 |
SubsystemVersion |
no |
|
| 44 |
Subsystem |
no |
0 = Unknown
1 = Native
2 = Windows GUI
3 = Windows command line
5 = OS/2 command line
7 = POSIX command line
9 = Windows CE GUI
10 = EFI application
11 = EFI boot service
12 = EFI runtime driver
13 = EFI ROM
14 = XBOX |
|
|
Information extracted from the VS_VERSION_INFO structure of Windows PE
files.
| Index4 | Tag Name |
Writable | Values / Notes |
|---|
| 2 |
FileVersionNumber |
no |
|
| 4 |
ProductVersionNumber |
no |
|
| 6 |
FileFlagsMask |
no |
|
| 7 |
FileFlags |
no |
Bit 0 = Debug
Bit 1 = Pre-release
Bit 2 = Patched | |
Bit 3 = Private build
Bit 4 = Info inferred
Bit 5 = Special build |
|
| 8 |
FileOS |
no |
0x1 = Win16
0x2 = PM-16
0x3 = PM-32
0x4 = Win32
0x10000 = DOS
0x10001 = Windows 16-bit
0x10004 = Windows 32-bit
0x20000 = OS/2 16-bit
0x20002 = OS/2 16-bit PM-16
0x30000 = OS/2 32-bit
0x30003 = OS/2 32-bit PM-32
0x40000 = Windows NT
0x40004 = Windows NT 32-bit |
|
| 9 |
ObjectFileType |
no |
0 = Unknown
1 = Executable application
2 = Dynamic link library
3 = Driver
4 = Font
5 = VxD
7 = Static library |
|
| 10 |
FileSubtype |
no |
|
|
Resource strings found in Windows PE files. The TagID's are not shown
because they are the same as the Tag Name. ExifTool will extract any
existing StringFileInfo tags even if not listed in this table.
| Tag Name |
Writable | Values / Notes |
|---|
| BuildDate |
no |
|
| BuildVersion |
no |
|
| CharacterSet |
no |
(extracted from the StringFileInfo value)
'0000' = ASCII
'03A4' = Windows, Japan (Shift - JIS X-0208)
'03A8' = Windows, Chinese (Simplified)
'03B5' = Windows, Korea (Shift - KSC 5601)
'03B6' = Windows, Taiwan (Big5)
'04B0' = Unicode
'04E2' = Windows, Latin2 (Eastern European)
'04E3' = Windows, Cyrillic
'04E4' = Windows, Latin1
'04E5' = Windows, Greek
'04E6' = Windows, Turkish
'04E7' = Windows, Hebrew
'04E8' = Windows, Arabic |
|
| Comments |
no |
|
| CompanyName |
no |
|
| Copyright |
no |
|
| FileDescription |
no |
|
| FileVersion |
no |
|
| InternalName |
no |
|
| LanguageCode |
no |
--> EXE LanguageCode Values
(Windows code page; extracted from the StringFileInfo value) |
| LegalCopyright |
no |
|
| LegalTrademarks |
no |
|
| OriginalFileName |
no |
|
| PrivateBuild |
no |
|
| ProductName |
no |
|
| ProductVersion |
no |
|
| SpecialBuild |
no |
|
|
See https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid
for the full list of Microsoft language codes.
| Value | LanguageCode | Value | LanguageCode | Value | LanguageCode |
|---|
| '0000' | = Neutral |
'0437' | = Georgian |
'040E' | = Hungarian |
| '0400' | = Process default |
'0438' | = Faeroese |
'040F' | = Icelandic |
| '0401' | = Arabic |
'0439' | = Hindi |
'041A' | = Croato-Serbian (Latin) |
| '0402' | = Bulgarian |
'0440' | = Kyrgyz |
'041B' | = Slovak |
| '0403' | = Catalan |
'0441' | = Swahili |
'041C' | = Albanian |
| '0404' | = Chinese (Traditional) |
'0443' | = Uzbek |
'041D' | = Swedish |
| '0405' | = Czech |
'0444' | = Tatar |
'041E' | = Thai |
| '0406' | = Danish |
'0445' | = Bengali |
'041F' | = Turkish |
| '0407' | = German |
'0446' | = Punjabi |
'042a' | = Vietnamese |
| '0408' | = Greek |
'0447' | = Gujarati |
'042b' | = Armenian |
| '0409' | = English (U.S.) |
'0448' | = Oriya |
'042c' | = Azeri |
| '0410' | = Italian |
'0449' | = Tamil |
'042d' | = Basque |
| '0411' | = Japanese |
'0450' | = Mongolian |
'042e' | = Sorbian |
| '0412' | = Korean |
'0456' | = Galician |
'042f' | = Macedonian |
| '0413' | = Dutch |
'0457' | = Konkani |
'043a' | = Maltese |
| '0414' | = Norwegian (Bokml) |
'0458' | = Manipuri |
'043b' | = Saami |
| '0415' | = Polish |
'0459' | = Sindhi |
'043c' | = Gaelic |
| '0416' | = Portuguese (Brazilian) |
'0460' | = Kashmiri |
'043e' | = Malay |
| '0417' | = Rhaeto-Romanic |
'0461' | = Nepali |
'043f' | = Kazak |
| '0418' | = Romanian |
'0465' | = Divehi |
'044a' | = Telugu |
| '0419' | = Russian |
'0490' | = Walon |
'044b' | = Kannada |
| '0420' | = Urdu |
'0491' | = Cornish |
'044c' | = Malayalam |
| '0421' | = Indonesian |
'0492' | = Welsh |
'044d' | = Assamese |
| '0422' | = Ukrainian |
'0493' | = Breton |
'044e' | = Marathi |
| '0423' | = Belarusian |
'0800' | = Neutral 2 |
'044f' | = Sanskrit |
| '0424' | = Slovenian |
'0804' | = Chinese (Simplified) |
'045a' | = Syriac |
| '0425' | = Estonian |
'0807' | = German (Swiss) |
'047f' | = Invariant |
| '0426' | = Latvian |
'0809' | = English (British) |
'048f' | = Esperanto |
| '0427' | = Lithuanian |
'0810' | = Italian (Swiss) |
'080A' | = Spanish (Mexican) |
| '0428' | = Maori |
'0813' | = Dutch (Belgian) |
'080C' | = French (Belgian) |
| '0429' | = Farsi |
'0814' | = Norwegian (Nynorsk) |
'081A' | = Serbo-Croatian (Cyrillic) |
| '0430' | = Sutu |
'0816' | = Portuguese |
'0C07' | = German (Austrian) |
| '0431' | = Tsonga |
'1009' | = English (Canadian) |
'0C09' | = English (Australian) |
| '0432' | = Tswana |
'007F' | = Invariant |
'0C0A' | = Spanish (Modern) |
| '0433' | = Venda |
'040A' | = Spanish (Castilian) |
'0C0C' | = French (Canadian) |
| '0434' | = Xhosa |
'040B' | = Finnish |
'100C' | = French (Swiss) |
| '0435' | = Zulu |
'040C' | = French |
| |
| '0436' | = Afrikaans |
'040D' | = Hebrew |
| |
|
Information extracted from Mach-O (Mac OS X) executable files and DYLIB
libraries.
| Index | Tag Name |
Writable | Values / Notes |
|---|
| 0 |
CPUArchitecture |
no |
|
| 1 |
CPUByteOrder |
no |
|
| 2 |
CPUCount |
no |
|
| 3 |
CPUType |
no+ |
-1 = Any
1 = VAX
2 = ROMP
4 = NS32032
5 = NS32332
6 = MC680x0
7 = x86
8 = MIPS
9 = NS32532
10 = MC98000 | |
11 = HPPA
12 = ARM
13 = MC88000
14 = SPARC
15 = i860 big endian
16 = i860 little endian
17 = RS6000
18 = PowerPC
255 = VEO |
|
| 4 |
CPUSubtype |
no+ |
'1 0' = VAX (all)
'1 1' = VAX780
'1 2' = VAX785
'1 3' = VAX750
'1 4' = VAX730
'1 5' = UVAXI
'1 6' = UVAXII
'1 7' = VAX8200
'1 8' = VAX8500
'1 9' = VAX8600
'1 10' = VAX8650
'1 11' = VAX8800
'1 12' = UVAXIII
'2 0' = RT (all)
'2 1' = RT PC
'2 2' = RT APC
'2 3' = RT 135
'4 0' = NS32032 (all)
'4 1' = NS32032 DPC (032 CPU)
'4 2' = NS32032 SQT
'4 3' = NS32032 APC FPU (32081)
'4 4' = NS32032 APC FPA (Weitek)
'4 5' = NS32032 XPC (532)
'5 0' = NS32332 (all)
'5 1' = NS32332 DPC (032 CPU)
'5 2' = NS32332 SQT
'5 3' = NS32332 APC FPU (32081)
'5 4' = NS32332 APC FPA (Weitek)
'5 5' = NS32332 XPC (532)
'6 1' = MC680x0 (all)
'6 2' = MC68040
'6 3' = MC68030
'7 3' = i386 (all)
'7 4' = i486
'7 5' = i586
'7 8' = Pentium III
'7 9' = Pentium M
'7 10' = Pentium 4
'7 11' = Itanium
'7 12' = Xeon
'7 22' = Pentium Pro
'7 24' = Pentium III M
'7 26' = Pentium 4 M
'7 27' = Itanium 2
'7 28' = Xeon MP
'7 40' = Pentium III Xeon
'7 54' = Pentium II M3
'7 86' = Pentium II M5
'7 103' = Celeron
'7 119' = Celeron Mobile
'7 132' = i486SX
'8 0' = MIPS (all)
'8 1' = MIPS R2300
'8 2' = MIPS R2600
'8 3' = MIPS R2800
'8 4' = MIPS R2000a
'8 5' = MIPS R2000
'8 6' = MIPS R3000a
'8 7' = MIPS R3000
'10 0' = MC98000 (all)
'10 1' = MC98601
'11 0' = HPPA (all)
'11 1' = HPPA 7100LC
'12 0' = ARM (all)
'12 1' = ARM A500 ARCH
'12 2' = ARM A500
'12 3' = ARM A440
'12 4' = ARM M4
'12 5' = ARM A680/V4T
'12 6' = ARM V6
'12 7' = ARM V5TEJ
'12 8' = ARM XSCALE
'12 9' = ARM V7
'13 0' = MC88000 (all)
'13 1' = MC88100
'13 2' = MC88110
'14 0' = SPARC (all)
'14 1' = SUN 4/260
'14 2' = SUN 4/110
'15 0' = i860 (all)
'15 1' = i860 860
'16 0' = i860 little (all)
'16 1' = i860 little
'17 0' = RS6000 (all)
'17 1' = RS6000
'18 0' = PowerPC (all)
'18 1' = PowerPC 601
'18 2' = PowerPC 602
'18 3' = PowerPC 603
'18 4' = PowerPC 603e
'18 5' = PowerPC 603ev
'18 6' = PowerPC 604
'18 7' = PowerPC 604e
'18 8' = PowerPC 620
'18 9' = PowerPC 750
'18 10' = PowerPC 7400
'18 11' = PowerPC 7450
'18 100' = PowerPC 970
'255 1' = VEO 1
'255 2' = VEO 2 |
|
| 5 |
ObjectFileType |
no |
-1 = Static library
0x1 = Relocatable object
0x2 = Demand paged executable
0x3 = Fixed VM shared library
0x4 = Core
0x5 = Preloaded executable
0x6 = Dynamically bound shared library
0x7 = Dynamic link editor
0x8 = Dynamically bound bundle
0x9 = Shared library stub for static linking
0xa = Debug information
0xb = x86_64 kexts |
|
| 6 |
ObjectFlags |
no |
Bit 0 = No undefs
Bit 1 = Incrementa link
Bit 2 = Dyld link
Bit 3 = Bind at load
Bit 4 = Prebound
Bit 5 = Split segs
Bit 6 = Lazy init
Bit 7 = Two level
Bit 8 = Force flat
Bit 9 = No multi defs
Bit 10 = No fix prebinding
Bit 11 = Prebindable
Bit 12 = All mods bound
Bit 13 = Subsections via symbols
Bit 14 = Canonical
Bit 15 = Weak defines
Bit 16 = Binds to weak
Bit 17 = Allow stack execution
Bit 18 = Dead strippable dylib
Bit 19 = Root safe
Bit 20 = No reexported dylibs
Bit 21 = Random address |
|
|
Information extracted from PEF (Classic MacOS) executable files and
libraries.
| Index4 | Tag Name |
Writable | Values / Notes |
|---|
| 2 |
CPUArchitecture |
no |
'm68k' = 68000
'pwpc' = PowerPC |
| 3 |
PEFVersion |
no |
|
| 4 |
TimeStamp |
no |
|
|
Information extracted from ELF (Unix) executable files and SO libraries.
| Index1 | Tag Name |
Writable | Values / Notes |
|---|
| 4 |
CPUArchitecture |
no |
1 = 32 bit
2 = 64 bit |
| 5 |
CPUByteOrder |
no |
1 = Little endian
2 = Big endian |
| 16 |
ObjectFileType |
no |
0 = None
1 = Relocatable file
2 = Executable file
3 = Shared object file
4 = Core file |
| 18 |
CPUType |
no |
0 = None
1 = AT&T WE 32100
2 = SPARC
3 = i386
4 = Motorola 68000
5 = Motorola 88000
6 = i486
7 = i860
8 = MIPS R3000
9 = IBM System/370
10 = MIPS R4000
15 = HP PA-RISC
18 = Sun v8plus
19 = Intel 80960
20 = PowerPC
21 = PowerPC 64-bit
22 = IBM S/390
23 = Cell BE SPU
36 = NEC V800
37 = Fujitsu FR20
38 = TRW RH-32
39 = Motorola RCE
40 = Arm (up to Armv7/AArch32)
41 = Digital Alpha
42 = SuperH
43 = SPARC v9 64-bit
44 = Siemens TriCore
45 = Argonaut RISC Core
46 = Renesas H8/300,300H,H8S
47 = Hitachi H8/300H
48 = Hitachi H8S
49 = Hitachi H8/500
50 = HP/Intel IA-64
51 = Stanford MIPS-X
52 = Motorola ColdFire
53 = Motorola M68HC12
54 = Fujitsu MMA Multimedia Accelerator
55 = Siemens PCP
56 = Sony nCPU embedded RISC processor
57 = Denso NDR1 microprocessor
58 = Motorola Star*Core processor
59 = Toyota ME16 processor
60 = STMicroelectronics ST100 processor
61 = Advanced Logic Corp. TinyJ embedded processor family
62 = AMD x86-64
63 = Sony DSP Processor
64 = Digital Equipment Corp. PDP-10
65 = Digital Equipment Corp. PDP-11
66 = Siemens FX66 microcontroller
67 = STMicroelectronics ST9+ 8/16 bit microcontroller
68 = STMicroelectronics ST7 8-bit microcontroller
69 = Motorola MC68HC16 Microcontroller
70 = Motorola MC68HC11 Microcontroller
71 = Motorola MC68HC08 Microcontroller
72 = Motorola MC68HC05 Microcontroller
73 = Silicon Graphics SVx
74 = STMicroelectronics ST19 8-bit microcontroller
75 = Digital VAX
76 = Axis Communications 32-bit embedded processor
77 = Infineon Technologies 32-bit embedded processor
78 = Element 14 64-bit DSP Processor
79 = LSI Logic 16-bit DSP Processor
87 = NEC v850
88 = Renesas M32R
140 = TMS320C6000 Family
175 = MCST Elbrus e2k
183 = Arm 64-bits (Armv8/AArch64)
220 = Zilog Z80
243 = RISC-V
247 = Berkeley Packet Filter
257 = WDC 65C816
21569 = Fujitsu FR-V
36902 = Alpha
36929 = m32r (old)
36992 = v850 (old)
41872 = S/390 (old) |
|
Information extracted from static libraries.
| Index1 | Tag Name |
Writable | Values / Notes |
|---|
| 16 |
CreateDate |
no |
|
|
Tags extracted from Microsoft Compiled HTML files.
(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Nov 19, 2023
<-- ExifTool Tag Names