<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>EXE Tags</title>
<link rel=stylesheet type='text/css' href='style.css' title='Style'>
</head>
<body>
<h2 class=top>EXE Tags</h2>
<p>This module extracts information from various types of Windows, MacOS and
Unix executable and library files. The first table below lists information
extracted from the header of Windows PE (Portable Executable) EXE files and
DLL libraries.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Index</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td class=r title='0 = 0x0'>0</td>
<td>MachineType</td>
<td class=c>N</td>
<td><span class=s>0x14c = Intel 386 or later, and compatibles
<br>0x14d = Intel i860
<br>0x162 = MIPS R3000
<br>0x166 = MIPS little endian (R4000)
<br>0x168 = MIPS R10000
<br>0x169 = MIPS little endian WCI v2
<br>0x183 = Alpha AXP (old)
<br>0x184 = Alpha AXP
<br>0x1a2 = Hitachi SH3
<br>0x1a3 = Hitachi SH3 DSP
<br>0x1a6 = Hitachi SH4
<br>0x1a8 = Hitachi SH5
<br>0x1c0 = ARM little endian
<br>0x1c2 = Thumb
<br>0x1d3 = Matsushita AM33
<br>0x1f0 = PowerPC little endian
<br>0x1f1 = PowerPC with floating point support
<br>0x200 = Intel IA64
<br>0x266 = MIPS16
<br>0x268 = Motorola 68000 series
<br>0x284 = Alpha AXP 64-bit
<br>0x366 = MIPS with FPU
<br>0x466 = MIPS16 with FPU
<br>0xebc = EFI Byte Code
<br>0x8664 = AMD AMD64
<br>0x9041 = Mitsubishi M32R little endian
<br>0xc0ee = clr pure MSIL</span></td></tr>
<tr class=b>
<td class=r title='2 = 0x2'>2</td>
<td>TimeStamp</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='10 = 0xa'>10</td>
<td>PEType</td>
<td class=c>N</td>
<td><span class=s>0x10b = PE32
<br>0x20b = PE32+</span></td></tr>
<tr class=b>
<td class=r title='11 = 0xb'>11</td>
<td>LinkerVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='12 = 0xc'>12</td>
<td>CodeSize</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='14 = 0xe'>14</td>
<td>InitializedDataSize</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='16 = 0x10'>16</td>
<td>UninitializedDataSize</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='18 = 0x12'>18</td>
<td>EntryPoint</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='30 = 0x1e'>30</td>
<td>OSVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='32 = 0x20'>32</td>
<td>ImageVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='34 = 0x22'>34</td>
<td>SubsystemVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='44 = 0x2c'>44</td>
<td>Subsystem</td>
<td class=c>N</td>
<td><span class=s>0 = Unknown
<br>1 = Native
<br>2 = Windows GUI
<br>3 = Windows command line
<br>5 = OS/2 Command line
<br>7 = POSIX command line
<br>9 = Windows CE GUI
<br>10 = EFI application
<br>11 = EFI boot service
<br>12 = EFI runtime driver
<br>13 = EFI ROM
<br>14 = XBOX</span></td></tr>
</table></td></tr></table></blockquote>
<h2><a name='PEVersion'>EXE PEVersion Tags</a></h2>
<p>Information extracted from the VS_VERSION_INFO structure of Windows PE
files.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Index</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td class=r title='2 = 0x2'>2</td>
<td>FileVersionNumber</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='4 = 0x4'>4</td>
<td>ProductVersionNumber</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='6 = 0x6'>6</td>
<td>FileFlagsMask</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='7 = 0x7'>7</td>
<td>FileFlags</td>
<td class=c>N</td>
<td><span class=s>Bit 0 = Debug
<br>Bit 1 = Pre-release
<br>Bit 2 = Patched
<br>Bit 3 = Private build
<br>Bit 4 = Info inferred
<br>Bit 5 = Special build</span></td></tr>
<tr>
<td class=r title='8 = 0x8'>8</td>
<td>FileOS</td>
<td class=c>N</td>
<td><span class=s>0x1 = Win16
<br>0x2 = PM-16
<br>0x3 = PM-32
<br>0x4 = Win32
<br>0x10000 = DOS
<br>0x10001 = Windows 16-bit
<br>0x10004 = Windows 32-bit
<br>0x20000 = OS/2 16-bit
<br>0x20002 = OS/2 16-bit PM-16
<br>0x30000 = OS/2 32-bit
<br>0x30003 = OS/2 32-bit PM-32
<br>0x40000 = Windows NT
<br>0x40004 = Windows NT 32-bit</span></td></tr>
<tr class=b>
<td class=r title='9 = 0x9'>9</td>
<td>ObjectFileType</td>
<td class=c>N</td>
<td><span class=s>0 = Unknown
<br>1 = Executable application
<br>2 = Dynamic link library
<br>3 = Driver
<br>4 = Font
<br>5 = VxD
<br>7 = Static library</span></td></tr>
<tr>
<td class=r title='10 = 0xa'>10</td>
<td>FileSubtype</td>
<td class=c>N</td>
<td> </td></tr>
</table></td></tr></table></blockquote>
<h2><a name='PEString'>EXE PEString Tags</a></h2>
<p>Resource strings found in Windows PE files. ExifTool will extract any
existing StringFileInfo tags even if not listed in this table.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Tag ID</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td>'BuildDate'</td>
<td>BuildDate</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'BuildVersion'</td>
<td>BuildVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'CharacterSet'</td>
<td>CharacterSet</td>
<td class=c>N</td>
<td><span class=s><span class=n>(extracted from the StringFileInfo value)</span>
<br>'0000' = ASCII
<br>'03A4' = Windows, Japan (Shift - JIS X-0208)
<br>'03A8' = Windows, Chinese (Simplified)
<br>'03B5' = Windows, Korea (Shift - KSC 5601)
<br>'03B6' = Windows, Taiwan (Big5)
<br>'04B0' = Unicode
<br>'04E2' = Windows, Latin2 (Eastern European)
<br>'04E3' = Windows, Cyrillic
<br>'04E4' = Windows, Latin1
<br>'04E5' = Windows, Greek
<br>'04E6' = Windows, Turkish
<br>'04E7' = Windows, Hebrew
<br>'04E8' = Windows, Arabic</span></td></tr>
<tr class=b>
<td>'Comments'</td>
<td>Comments</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'CompanyName'</td>
<td>CompanyName</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'Copyright'</td>
<td>Copyright</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'FileDescription'</td>
<td>FileDescription</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'FileVersion'</td>
<td>FileVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'InternalName'</td>
<td>InternalName</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'LanguageCode'</td>
<td>LanguageCode</td>
<td class=c>N</td>
<td><span class=s><span class=n>(extracted from the StringFileInfo value)</span>
<br>'0000' = Neutral
<br>'0400' = Process default
<br>'0401' = Arabic
<br>'0402' = Bulgarian
<br>'0403' = Catalan
<br>'0404' = Chinese (Traditional)
<br>'0405' = Czech
<br>'0406' = Danish
<br>'0407' = German
<br>'0408' = Greek
<br>'0409' = English (U.S.)
<br>'0410' = Italian
<br>'0411' = Japanese
<br>'0412' = Korean
<br>'0413' = Dutch
<br>'0414' = Norwegian (Bokml)
<br>'0415' = Polish
<br>'0416' = Portuguese (Brazilian)
<br>'0417' = Rhaeto-Romanic
<br>'0418' = Romanian
<br>'0419' = Russian
<br>'0420' = Urdu
<br>'0421' = Indonesian
<br>'0422' = Ukrainian
<br>'0423' = Belarusian
<br>'0424' = Slovenian
<br>'0425' = Estonian
<br>'0426' = Latvian
<br>'0427' = Lithuanian
<br>'0428' = Maori
<br>'0429' = Farsi
<br>'0430' = Sutu
<br>'0431' = Tsonga
<br>'0432' = Tswana
<br>'0433' = Venda
<br>'0434' = Xhosa
<br>'0435' = Zulu
<br>'0436' = Afrikaans
<br>'0437' = Georgian
<br>'0438' = Faeroese
<br>'0439' = Hindi
<br>'0440' = Kyrgyz
<br>'0441' = Swahili
<br>'0443' = Uzbek
<br>'0444' = Tatar
<br>'0445' = Bengali
<br>'0446' = Punjabi
<br>'0447' = Gujarati
<br>'0448' = Oriya
<br>'0449' = Tamil
<br>'0450' = Mongolian
<br>'0456' = Galician
<br>'0457' = Konkani
<br>'0458' = Manipuri
<br>'0459' = Sindhi
<br>'0460' = Kashmiri
<br>'0461' = Nepali
<br>'0465' = Divehi
<br>'0490' = Walon
<br>'0491' = Cornish
<br>'0492' = Welsh
<br>'0493' = Breton
<br>'0800' = Neutral 2
<br>'0804' = Chinese (Simplified)
<br>'0807' = German (Swiss)
<br>'0809' = English (British)
<br>'0810' = Italian (Swiss)
<br>'0813' = Dutch (Belgian)
<br>'0814' = Norwegian (Nynorsk)
<br>'0816' = Portuguese
<br>'1009' = English (Canadian)
<br>'007F' = Invariant
<br>'040A' = Spanish (Castilian)
<br>'040B' = Finnish
<br>'040C' = French
<br>'040D' = Hebrew
<br>'040E' = Hungarian
<br>'040F' = Icelandic
<br>'041A' = Croato-Serbian (Latin)
<br>'041B' = Slovak
<br>'041C' = Albanian
<br>'041D' = Swedish
<br>'041E' = Thai
<br>'041F' = Turkish
<br>'042a' = Vietnamese
<br>'042b' = Armenian
<br>'042c' = Azeri
<br>'042d' = Basque
<br>'042e' = Sorbian
<br>'042f' = Macedonian
<br>'043a' = Maltese
<br>'043b' = Saami
<br>'043c' = Gaelic
<br>'043e' = Malay
<br>'043f' = Kazak
<br>'044a' = Telugu
<br>'044b' = Kannada
<br>'044c' = Malayalam
<br>'044d' = Assamese
<br>'044e' = Marathi
<br>'044f' = Sanskrit
<br>'045a' = Syriac
<br>'047f' = Invariant
<br>'048f' = Esperanto
<br>'080A' = Spanish (Mexican)
<br>'080C' = French (Belgian)
<br>'081A' = Serbo-Croatian (Cyrillic)
<br>'0C07' = German (Austrian)
<br>'0C09' = English (Australian)
<br>'0C0A' = Spanish (Modern)
<br>'0C0C' = French (Canadian)
<br>'100C' = French (Swiss)</span></td></tr>
<tr>
<td>'LegalCopyright'</td>
<td>LegalCopyright</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'LegalTrademarks'</td>
<td>LegalTrademarks</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'OriginalFilename'</td>
<td>OriginalFilename</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'PrivateBuild'</td>
<td>PrivateBuild</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'ProductName'</td>
<td>ProductName</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td>'ProductVersion'</td>
<td>ProductVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td>'SpecialBuild'</td>
<td>SpecialBuild</td>
<td class=c>N</td>
<td> </td></tr>
</table></td></tr></table></blockquote>
<h2><a name='MachO'>EXE MachO Tags</a></h2>
<p>Information extracted from Mach-O (Mac OS X) executable files and DYLIB
libraries.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Index</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td class=r title='0 = 0x0'>0</td>
<td>CPUArchitecture</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='1 = 0x1'>1</td>
<td>CPUByteOrder</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='2 = 0x2'>2</td>
<td>CPUCount</td>
<td class=c>N</td>
<td> </td></tr>
<tr class=b>
<td class=r title='3 = 0x3'>3</td>
<td>CPUType</td>
<td class=c title='+ = List'>N+</td>
<td><span class=s>-1 = Any
<br>1 = VAX
<br>2 = ROMP
<br>4 = NS32032
<br>5 = NS32332
<br>6 = MC680x0
<br>7 = x86
<br>8 = MIPS
<br>9 = NS32532
<br>11 = HPPA
<br>12 = ARM
<br>13 = MC88000
<br>14 = SPARC
<br>15 = i860 big endian
<br>16 = i860 little endian
<br>17 = RS6000
<br>18 = PowerPC
<br>255 = VEO
<br>16777223 = x86 64-bit
<br>16777234 = PowerPC 64-bit</span></td></tr>
<tr>
<td class=r title='4 = 0x4'>4</td>
<td>CPUSubtype</td>
<td class=c title='+ = List'>N+</td>
<td><span class=s>'1 0' = VAX (all)
<br>'1 1' = VAX780
<br>'1 2' = VAX785
<br>'1 3' = VAX750
<br>'1 4' = VAX730
<br>'1 5' = UVAXI
<br>'1 6' = UVAXII
<br>'1 7' = VAX8200
<br>'1 8' = VAX8500
<br>'1 9' = VAX8600
<br>'1 10' = VAX8650
<br>'1 11' = VAX8800
<br>'1 12' = UVAXIII
<br>'2 0' = RT (all)
<br>'2 1' = RT PC
<br>'2 2' = RT APC
<br>'2 3' = RT 135
<br>'4 0' = NS32032 (all)
<br>'4 1' = NS32032 DPC (032 CPU)
<br>'4 2' = NS32032 SQT
<br>'4 3' = NS32032 APC FPU (32081)
<br>'4 4' = NS32032 APC FPA (Weitek)
<br>'4 5' = NS32032 XPC (532)
<br>'5 0' = NS32332 (all)
<br>'5 1' = NS32332 DPC (032 CPU)
<br>'5 2' = NS32332 SQT
<br>'5 3' = NS32332 APC FPU (32081)
<br>'5 4' = NS32332 APC FPA (Weitek)
<br>'5 5' = NS32332 XPC (532)
<br>'6 1' = MC680x0 (all)
<br>'6 2' = MC68040
<br>'6 3' = MC68030
<br>'7 3' = i386 (all)
<br>'7 4' = i486
<br>'7 5' = i586
<br>'7 10' = Pentium 4
<br>'7 22' = Pentium Pro
<br>'7 54' = PentiumII M3
<br>'7 86' = PentiumII M5
<br>'7 132' = i486SX
<br>'8 0' = MIPS (all)
<br>'8 1' = MIPS R2300
<br>'8 2' = MIPS R2600
<br>'8 3' = MIPS R2800
<br>'8 4' = MIPS R2000a
<br>'11 0' = HPPA (all)
<br>'11 1' = HPPA 7100LC
<br>'12 0' = ARM (all)
<br>'12 1' = ARM A500 ARCH
<br>'12 2' = ARM A500
<br>'12 3' = ARM A440
<br>'12 4' = ARM M4
<br>'12 5' = ARM A680
<br>'13 0' = MC88000 (all)
<br>'13 1' = MC88100
<br>'13 2' = MC88110
<br>'14 0' = SPARC (all)
<br>'14 1' = SUN 4/260
<br>'14 2' = SUN 4/110
<br>'15 0' = i860 (all)
<br>'15 1' = i860 860
<br>'16 0' = i860 little (all)
<br>'16 1' = i860 little
<br>'17 0' = RS6000 (all)
<br>'17 1' = RS6000
<br>'18 0' = PowerPC (all)
<br>'18 1' = PowerPC 601
<br>'18 2' = PowerPC 602
<br>'18 3' = PowerPC 603
<br>'18 4' = PowerPC 603e
<br>'18 5' = PowerPC 603ev
<br>'18 6' = PowerPC 604
<br>'18 7' = PowerPC 604e
<br>'18 8' = PowerPC 620
<br>'18 9' = PowerPC 750
<br>'18 10' = PowerPC 7400
<br>'18 11' = PowerPC 7450
<br>'18 100' = PowerPC 970
<br>'16777223 3' = i386 64-bit (all)
<br>'16777223 4' = i486 64-bit
<br>'16777223 5' = i586 64-bit
<br>'16777223 10' = Pentium 4 64-bit
<br>'16777223 22' = Pentium Pro 64-bit
<br>'16777223 54' = PentiumII M3 64-bit
<br>'16777223 86' = PentiumII M5 64-bit
<br>'16777223 132' = i486SX 64-bit
<br>'16777234 0' = PowerPC 64-bit (all)
<br>'255 1' = VEO 1
<br>'255 2' = VEO 2</span></td></tr>
<tr class=b>
<td class=r title='5 = 0x5'>5</td>
<td>ObjectFileType</td>
<td class=c>N</td>
<td><span class=s>-1 = Static library
<br>0x1 = Relocatable object
<br>0x2 = Demand paged executable
<br>0x3 = Fixed VM shared library
<br>0x4 = Core
<br>0x5 = Preloaded executable
<br>0x6 = Dynamically bound shared library
<br>0x7 = Dynamic link editor
<br>0x8 = Dynamically bound bundle
<br>0x9 = Shared library stub for static linking</span></td></tr>
</table></td></tr></table></blockquote>
<h2><a name='PEF'>EXE PEF Tags</a></h2>
<p>Information extracted from PEF (Classic MacOS) executable files and
libraries.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Index</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td class=r title='2 = 0x2'>2</td>
<td>CPUArchitecture</td>
<td class=c>N</td>
<td><span class=s>'m68k' = 68000
<br>'pwpc' = PowerPC</span></td></tr>
<tr class=b>
<td class=r title='3 = 0x3'>3</td>
<td>PEFVersion</td>
<td class=c>N</td>
<td> </td></tr>
<tr>
<td class=r title='4 = 0x4'>4</td>
<td>TimeStamp</td>
<td class=c>N</td>
<td> </td></tr>
</table></td></tr></table></blockquote>
<h2><a name='ELF'>EXE ELF Tags</a></h2>
<p>Information extracted from ELF (Unix) executable files and SO libraries.</p>
<blockquote>
<table class=frame><tr><td>
<table class=inner cellspacing=1>
<tr class=h><th>Index</th><th>Tag Name</th>
<th>Writable</th><th>Values / <span class=n>Notes</span></th></tr>
<tr>
<td class=r title='4 = 0x4'>4</td>
<td>CPUArchitecture</td>
<td class=c>N</td>
<td><span class=s>1 = 32 bit
<br>2 = 64 bit</span></td></tr>
<tr class=b>
<td class=r title='5 = 0x5'>5</td>
<td>CPUByteOrder</td>
<td class=c>N</td>
<td><span class=s>1 = Little endian
<br>2 = Big endian</span></td></tr>
<tr>
<td class=r title='16 = 0x10'>16</td>
<td>ObjectFileType</td>
<td class=c>N</td>
<td><span class=s>0 = None
<br>1 = Relocatable file
<br>2 = Executable file
<br>3 = Shared object file
<br>4 = Core file</span></td></tr>
<tr class=b>
<td class=r title='18 = 0x12'>18</td>
<td>CPUType</td>
<td class=c>N</td>
<td><span class=s>0 = None
<br>1 = AT&T WE 32100
<br>2 = SPARC
<br>3 = i386
<br>4 = Motorola 68000
<br>5 = Motorola 88000
<br>6 = i486
<br>7 = i860
<br>8 = MIPS R3000
<br>10 = MIPS R4000
<br>15 = HPPA
<br>18 = Sun v8plus
<br>20 = PowerPC
<br>21 = PowerPC 64-bit
<br>22 = IBM S/390
<br>23 = Cell BE SPU
<br>42 = SuperH
<br>43 = SPARC v9 64-bit
<br>46 = Renesas H8/300,300H,H8S
<br>50 = HP/Intel IA-64
<br>62 = AMD x86-64
<br>76 = Axis Communications 32-bit embedded processor
<br>87 = NEC v850
<br>88 = Renesas M32R
<br>21569 = Fujitsu FR-V
<br>36902 = Alpha
<br>36929 = m32r (old)
<br>36992 = v850 (old)
<br>41872 = S/390 (old)</span></td></tr>
</table></td></tr></table></blockquote>
<hr>
(This document generated automatically by Image::ExifTool::BuildTagLookup)
<br><i>Last revised Jan 22, 2010</i>
<p class=lf><a href='index.html'><-- ExifTool Tag Names</a></p>
</body>
</html>