## EXE Tags

This module extracts information from various types of Windows, MacOS and Unix executable and library files. The first table below lists information extracted from the header of Windows PE (Portable Executable) EXE files and DLL libraries.

> Index2 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---

> 0

> MachineType

> N

> 0x14c = Intel 386 or later, and compatibles
> 0x14d = Intel i860
> 0x162 = MIPS R3000
> 0x166 = MIPS little endian (R4000)
> 0x168 = MIPS R10000
> 0x169 = MIPS little endian WCI v2
> 0x183 = Alpha AXP (old)
> 0x184 = Alpha AXP
> 0x1a2 = Hitachi SH3
> 0x1a3 = Hitachi SH3 DSP
> 0x1a6 = Hitachi SH4
> 0x1a8 = Hitachi SH5
> 0x1c0 = ARM little endian
> 0x1c2 = Thumb
> 0x1d3 = Matsushita AM33
> 0x1f0 = PowerPC little endian
> 0x1f1 = PowerPC with floating point support
> 0x200 = Intel IA64
> 0x266 = MIPS16
> 0x268 = Motorola 68000 series
> 0x284 = Alpha AXP 64-bit
> 0x366 = MIPS with FPU
> 0x466 = MIPS16 with FPU
> 0xebc = EFI Byte Code
> 0x8664 = AMD AMD64
> 0x9041 = Mitsubishi M32R little endian
> 0xc0ee = clr pure MSIL

> 2 | TimeStamp | N |
> 10 | PEType | N | 0x10b = PE32 0x20b = PE32+
> 11 | LinkerVersion | N |
> 12 | CodeSize | N |
> 14 | InitializedDataSize | N |
> 16 | UninitializedDataSize | N |
> 18 | EntryPoint | N |
> 30 | OSVersion | N |
> 32 | ImageVersion | N |
> 34 | SubsystemVersion | N |

> 44

> Subsystem

> N

> 0 = Unknown 1 = Native 2 = Windows GUI 3 = Windows command line 5 = OS/2 command line 7 = POSIX command line 9 = Windows CE GUI 10 = EFI application 11 = EFI boot service 12 = EFI runtime driver 13 = EFI ROM 14 = XBOX |

## EXE PEVersion Tags

Information extracted from the VS_VERSION_INFO structure of Windows PE files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | FileVersionNumber | N |
> 4 | ProductVersionNumber | N |
> 6 | FileFlagsMask | N |

> 7

> FileFlags

> N

> Bit 0 = Debug Bit 1 = Pre-release Bit 2 = Patched |  | Bit 3 = Private build Bit 4 = Info inferred Bit 5 = Special build |

> 8

> FileOS

> N

> 0x1 = Win16 0x2 = PM-16 0x3 = PM-32 0x4 = Win32 0x10000 = DOS 0x10001 = Windows 16-bit 0x10004 = Windows 32-bit 0x20000 = OS/2 16-bit 0x20002 = OS/2 16-bit PM-16 0x30000 = OS/2 32-bit 0x30003 = OS/2 32-bit PM-32 0x40000 = Windows NT 0x40004 = Windows NT 32-bit |

> 9

> ObjectFileType

> N

> 0 = Unknown 1 = Executable application 2 = Dynamic link library 3 = Driver 4 = Font 5 = VxD 7 = Static library |

> 10 | FileSubtype | N |

## EXE PEString Tags

Resource strings found in Windows PE files. The TagID's are not shown because they are the same as the Tag Name. ExifTool will extract any existing StringFileInfo tags even if not listed in this table.

> Tag Name | Writable | Values / Notes
> --- | --- | ---
> BuildDate | N |
> BuildVersion | N |

> CharacterSet

> N

> (extracted from the StringFileInfo value)

> '0000' = ASCII '03A4' = Windows, Japan (Shift - JIS X-0208) '03A8' = Windows, Chinese (Simplified) '03B5' = Windows, Korea (Shift - KSC 5601) '03B6' = Windows, Taiwan (Big5) '04B0' = Unicode '04E2' = Windows, Latin2 (Eastern European) '04E3' = Windows, Cyrillic '04E4' = Windows, Latin1 '04E5' = Windows, Greek '04E6' = Windows, Turkish '04E7' = Windows, Hebrew '04E8' = Windows, Arabic |

> Comments | N |
> CompanyName | N |
> Copyright | N |
> FileDescription | N |
> FileVersion | N |
> InternalName | N |
> LanguageCode | N | --> EXE LanguageCode Values (extracted from the StringFileInfo value)
> LegalCopyright | N |
> LegalTrademarks | N |
> OriginalFilename | N |
> PrivateBuild | N |
> ProductName | N |
> ProductVersion | N |
> SpecialBuild | N |

## EXE LanguageCode Values

> Value | LanguageCode | Value | LanguageCode | Value | LanguageCode
> --- | --- | --- | --- | --- | ---
> '0000' | = Neutral | '0437' | = Georgian | '040E' | = Hungarian
> '0400' | = Process default | '0438' | = Faeroese | '040F' | = Icelandic
> '0401' | = Arabic | '0439' | = Hindi | '041A' | = Croato-Serbian (Latin)
> '0402' | = Bulgarian | '0440' | = Kyrgyz | '041B' | = Slovak
> '0403' | = Catalan | '0441' | = Swahili | '041C' | = Albanian
> '0404' | = Chinese (Traditional) | '0443' | = Uzbek | '041D' | = Swedish
> '0405' | = Czech | '0444' | = Tatar | '041E' | = Thai
> '0406' | = Danish | '0445' | = Bengali | '041F' | = Turkish
> '0407' | = German | '0446' | = Punjabi | '042a' | = Vietnamese
> '0408' | = Greek | '0447' | = Gujarati | '042b' | = Armenian
> '0409' | = English (U.S.) | '0448' | = Oriya | '042c' | = Azeri
> '0410' | = Italian | '0449' | = Tamil | '042d' | = Basque
> '0411' | = Japanese | '0450' | = Mongolian | '042e' | = Sorbian
> '0412' | = Korean | '0456' | = Galician | '042f' | = Macedonian
> '0413' | = Dutch | '0457' | = Konkani | '043a' | = Maltese
> '0414' | = Norwegian (Bokml) | '0458' | = Manipuri | '043b' | = Saami
> '0415' | = Polish | '0459' | = Sindhi | '043c' | = Gaelic
> '0416' | = Portuguese (Brazilian) | '0460' | = Kashmiri | '043e' | = Malay
> '0417' | = Rhaeto-Romanic | '0461' | = Nepali | '043f' | = Kazak
> '0418' | = Romanian | '0465' | = Divehi | '044a' | = Telugu
> '0419' | = Russian | '0490' | = Walon | '044b' | = Kannada
> '0420' | = Urdu | '0491' | = Cornish | '044c' | = Malayalam
> '0421' | = Indonesian | '0492' | = Welsh | '044d' | = Assamese
> '0422' | = Ukrainian | '0493' | = Breton | '044e' | = Marathi
> '0423' | = Belarusian | '0800' | = Neutral 2 | '044f' | = Sanskrit
> '0424' | = Slovenian | '0804' | = Chinese (Simplified) | '045a' | = Syriac
> '0425' | = Estonian | '0807' | = German (Swiss) | '047f' | = Invariant
> '0426' | = Latvian | '0809' | = English (British) | '048f' | = Esperanto
> '0427' | = Lithuanian | '0810' | = Italian (Swiss) | '080A' | = Spanish (Mexican)
> '0428' | = Maori | '0813' | = Dutch (Belgian) | '080C' | = French (Belgian)
> '0429' | = Farsi | '0814' | = Norwegian (Nynorsk) | '081A' | = Serbo-Croatian (Cyrillic)
> '0430' | = Sutu | '0816' | = Portuguese | '0C07' | = German (Austrian)
> '0431' | = Tsonga | '1009' | = English (Canadian) | '0C09' | = English (Australian)
> '0432' | = Tswana | '007F' | = Invariant | '0C0A' | = Spanish (Modern)
> '0433' | = Venda | '040A' | = Spanish (Castilian) | '0C0C' | = French (Canadian)
> '0434' | = Xhosa | '040B' | = Finnish | '100C' | = French (Swiss)
> '0435' | = Zulu | '040C' | = French |  |
> '0436' | = Afrikaans | '040D' | = Hebrew |  |

## EXE MachO Tags

Information extracted from Mach-O (Mac OS X) executable files and DYLIB libraries.

> Index | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | CPUArchitecture | N |
> 1 | CPUByteOrder | N |
> 2 | CPUCount | N |

> 3

> CPUType

> N+

> -1 = Any 1 = VAX 2 = ROMP 4 = NS32032 5 = NS32332 6 = MC680x0 7 = x86 8 = MIPS 9 = NS32532 10 = MC98000 |  | 11 = HPPA 12 = ARM 13 = MC88000 14 = SPARC 15 = i860 big endian 16 = i860 little endian 17 = RS6000 18 = PowerPC 255 = VEO |

> 4

> CPUSubtype

> N+

> '1 0' = VAX (all)
> '1 1' = VAX780
> '1 2' = VAX785
> '1 3' = VAX750
> '1 4' = VAX730
> '1 5' = UVAXI
> '1 6' = UVAXII
> '1 7' = VAX8200
> '1 8' = VAX8500
> '1 9' = VAX8600
> '1 10' = VAX8650
> '1 11' = VAX8800
> '1 12' = UVAXIII
> '2 0' = RT (all)
> '2 1' = RT PC
> '2 2' = RT APC
> '2 3' = RT 135
> '4 0' = NS32032 (all)
> '4 1' = NS32032 DPC (032 CPU)
> '4 2' = NS32032 SQT
> '4 3' = NS32032 APC FPU (32081)
> '4 4' = NS32032 APC FPA (Weitek)
> '4 5' = NS32032 XPC (532)
> '5 0' = NS32332 (all)
> '5 1' = NS32332 DPC (032 CPU)
> '5 2' = NS32332 SQT
> '5 3' = NS32332 APC FPU (32081)
> '5 4' = NS32332 APC FPA (Weitek)
> '5 5' = NS32332 XPC (532)
> '6 1' = MC680x0 (all)
> '6 2' = MC68040
> '6 3' = MC68030
> '7 3' = i386 (all)
> '7 4' = i486
> '7 5' = i586
> '7 8' = Pentium III
> '7 9' = Pentium M
> '7 10' = Pentium 4
> '7 11' = Itanium
> '7 12' = Xeon
> '7 22' = Pentium Pro
> '7 24' = Pentium III M
> '7 26' = Pentium 4 M
> '7 27' = Itanium 2
> '7 28' = Xeon MP
> '7 40' = Pentium III Xeon
> '7 54' = Pentium II M3
> '7 86' = Pentium II M5
> '7 103' = Celeron
> '7 119' = Celeron Mobile
> '7 132' = i486SX
> '8 0' = MIPS (all)
> '8 1' = MIPS R2300
> '8 2' = MIPS R2600
> '8 3' = MIPS R2800
> '8 4' = MIPS R2000a
> '8 5' = MIPS R2000
> '8 6' = MIPS R3000a
> '8 7' = MIPS R3000
> '10 0' = MC98000 (all)
> '10 1' = MC98601
> '11 0' = HPPA (all)
> '11 1' = HPPA 7100LC
> '12 0' = ARM (all)
> '12 1' = ARM A500 ARCH
> '12 2' = ARM A500
> '12 3' = ARM A440
> '12 4' = ARM M4
> '12 5' = ARM A680/V4T
> '12 6' = ARM V6
> '12 7' = ARM V5TEJ
> '12 8' = ARM XSCALE
> '12 9' = ARM V7
> '13 0' = MC88000 (all)
> '13 1' = MC88100
> '13 2' = MC88110
> '14 0' = SPARC (all)
> '14 1' = SUN 4/260
> '14 2' = SUN 4/110
> '15 0' = i860 (all)
> '15 1' = i860 860
> '16 0' = i860 little (all)
> '16 1' = i860 little
> '17 0' = RS6000 (all)
> '17 1' = RS6000
> '18 0' = PowerPC (all)
> '18 1' = PowerPC 601
> '18 2' = PowerPC 602
> '18 3' = PowerPC 603
> '18 4' = PowerPC 603e
> '18 5' = PowerPC 603ev
> '18 6' = PowerPC 604
> '18 7' = PowerPC 604e
> '18 8' = PowerPC 620
> '18 9' = PowerPC 750
> '18 10' = PowerPC 7400
> '18 11' = PowerPC 7450
> '18 100' = PowerPC 970
> '255 1' = VEO 1
> '255 2' = VEO 2

> 5

> ObjectFileType

> N

> -1 = Static library 0x1 = Relocatable object 0x2 = Demand paged executable 0x3 = Fixed VM shared library 0x4 = Core 0x5 = Preloaded executable 0x6 = Dynamically bound shared library 0x7 = Dynamic link editor 0x8 = Dynamically bound bundle 0x9 = Shared library stub for static linking |

## EXE PEF Tags

Information extracted from PEF (Classic MacOS) executable files and libraries.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | CPUArchitecture | N | 'm68k' = 68000 'pwpc' = PowerPC
> 3 | PEFVersion | N |
> 4 | TimeStamp | N |

## EXE ELF Tags

Information extracted from ELF (Unix) executable files and SO libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 4 | CPUArchitecture | N | 1 = 32 bit 2 = 64 bit
> 5 | CPUByteOrder | N | 1 = Little endian 2 = Big endian
> 16 | ObjectFileType | N | 0 = None 1 = Relocatable file 2 = Executable file 3 = Shared object file 4 = Core file

> 18

> CPUType

> N

> 0 = None
> 1 = AT&T WE 32100
> 2 = SPARC
> 3 = i386
> 4 = Motorola 68000
> 5 = Motorola 88000
> 6 = i486
> 7 = i860
> 8 = MIPS R3000
> 10 = MIPS R4000
> 15 = HPPA
> 18 = Sun v8plus
> 20 = PowerPC
> 21 = PowerPC 64-bit
> 22 = IBM S/390
> 23 = Cell BE SPU
> 42 = SuperH
> 43 = SPARC v9 64-bit
> 46 = Renesas H8/300,300H,H8S
> 50 = HP/Intel IA-64
> 62 = AMD x86-64
> 76 = Axis Communications 32-bit embedded processor
> 87 = NEC v850
> 88 = Renesas M32R
> 21569 = Fujitsu FR-V
> 36902 = Alpha
> 36929 = m32r (old)
> 36992 = v850 (old)
> 41872 = S/390 (old)

## EXE CHM Tags

Tags extracted from Microsoft Compiled HTML files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 1 | CHMVersion | N |
> 5 | LanguageCode | N | --> EXE LanguageCode Values

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Jul 12, 2011

<-- ExifTool Tag Names