## EXE Tags

This module extracts information from various types of Windows, MacOS and Unix executable and library files. The first table below lists information extracted from the header of Windows PE (Portable Executable) EXE files and DLL libraries.

> Index2 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---

> 0

> MachineType

> no

> 0x0 = Unknown
> 0x1 = Target host
> 0x14c = Intel 386 or later, and compatibles
> 0x14d = Intel i860
> 0x162 = MIPS R3000
> 0x166 = MIPS little endian (R4000)
> 0x168 = MIPS R10000
> 0x169 = MIPS little endian WCI v2
> 0x183 = Alpha AXP (old)
> 0x184 = Alpha AXP
> 0x1a2 = Hitachi SH3
> 0x1a3 = Hitachi SH3 DSP
> 0x1a4 = Hitachi SH3E
> 0x1a6 = Hitachi SH4
> 0x1a8 = Hitachi SH5
> 0x1c0 = ARM little endian
> 0x1c2 = Thumb
> 0x1c4 = Thumb 2 little endian
> 0x1d3 = Matsushita AM33
> 0x1f0 = PowerPC little endian
> 0x1f1 = PowerPC with floating point support
> 0x200 = Intel IA64
> 0x266 = MIPS16
> 0x268 = Motorola 68000 series
> 0x284 = Alpha AXP 64-bit
> 0x366 = MIPS with FPU
> 0x466 = MIPS16 with FPU
> 0x520 = Infineon Tricore
> 0xcef = CEF
> 0xebc = EFI Byte Code
> 0x3a64 = Compiled Hybrid PE
> 0x5032 = RISC-V 32-bit
> 0x5064 = RISC-V 64-bit
> 0x5128 = RISC-V 128-bit
> 0x6232 = LoongArch 32-bit
> 0x6264 = LoongArch 64-bit
> 0x8664 = AMD AMD64
> 0x9041 = Mitsubishi M32R little endian
> 0xaa64 = ARM64 little endian
> 0xc0ee = clr pure MSIL
> 0xec20 = Dotnet 0xEC20

> 2 | TimeStamp | no |

> 9

> ImageFileCharacteristics

> no

> Bit 0 = No relocs Bit 1 = Executable Bit 2 = No line numbers Bit 3 = No symbols Bit 4 = Aggressive working-set trim Bit 5 = Large address aware Bit 7 = Bytes reversed lo Bit 8 = 32-bit Bit 9 = No debug Bit 10 = Removable run from swap Bit 11 = Net run from swap Bit 12 = System file Bit 13 = DLL Bit 14 = Uniprocessor only Bit 15 = Bytes reversed hi

> 10 | PEType | no | 0x107 = ROM Image 0x10b = PE32 0x20b = PE32+
> 11 | LinkerVersion | no |
> 12 | CodeSize | no |
> 14 | InitializedDataSize | no |
> 16 | UninitializedDataSize | no |
> 18 | EntryPoint | no |
> 30 | OSVersion | no |
> 32 | ImageVersion | no |
> 34 | SubsystemVersion | no |

> 44

> Subsystem

> no

> 0 = Unknown 1 = Native 2 = Windows GUI 3 = Windows command line 5 = OS/2 command line 7 = POSIX command line 9 = Windows CE GUI 10 = EFI application 11 = EFI boot service 12 = EFI runtime driver 13 = EFI ROM 14 = XBOX

## EXE PEVersion Tags

Information extracted from the VS_VERSION_INFO structure of Windows PE files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | FileVersionNumber | no |
> 4 | ProductVersionNumber | no |
> 6 | FileFlagsMask | no |

> 7

> FileFlags

> no

> Bit 0 = Debug Bit 1 = Pre-release Bit 2 = Patched |  | Bit 3 = Private build Bit 4 = Info inferred Bit 5 = Special build

> 8

> FileOS

> no

> 0x1 = Win16 0x2 = PM-16 0x3 = PM-32 0x4 = Win32 0x10000 = DOS 0x10001 = Windows 16-bit 0x10004 = Windows 32-bit 0x20000 = OS/2 16-bit 0x20002 = OS/2 16-bit PM-16 0x30000 = OS/2 32-bit 0x30003 = OS/2 32-bit PM-32 0x40000 = Windows NT 0x40004 = Windows NT 32-bit

> 9

> ObjectFileType

> no

> 0 = Unknown 1 = Executable application 2 = Dynamic link library 3 = Driver 4 = Font 5 = VxD 7 = Static library

> 10 | FileSubtype | no |

## EXE PEString Tags

Resource strings found in Windows PE files. The TagID's are not shown because they are the same as the Tag Name. ExifTool will extract any existing StringFileInfo tags even if not listed in this table.

> Tag Name | Writable | Values / Notes
> --- | --- | ---
> BuildDate | no |
> BuildVersion | no |

> CharacterSet

> no

> (extracted from the StringFileInfo value)

> '0000' = ASCII '03A4' = Windows, Japan (Shift - JIS X-0208) '03A8' = Windows, Chinese (Simplified) '03B5' = Windows, Korea (Shift - KSC 5601) '03B6' = Windows, Taiwan (Big5) '04B0' = Unicode '04E2' = Windows, Latin2 (Eastern European) '04E3' = Windows, Cyrillic '04E4' = Windows, Latin1 '04E5' = Windows, Greek '04E6' = Windows, Turkish '04E7' = Windows, Hebrew '04E8' = Windows, Arabic

> Comments | no |
> CompanyName | no |
> Copyright | no |
> FileDescription | no |
> FileVersion | no |
> InternalName | no |
> LanguageCode | no | --> EXE LanguageCode Values (Windows code page; extracted from the StringFileInfo value)
> LegalCopyright | no |
> LegalTrademarks | no |
> OriginalFileName | no |
> PrivateBuild | no |
> ProductName | no |
> ProductVersion | no |
> SpecialBuild | no |

## EXE LanguageCode Values

See https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid for the full list of Microsoft language codes.

> Value | LanguageCode | Value | LanguageCode | Value | LanguageCode
> --- | --- | --- | --- | --- | ---
> '0000' | = Neutral | '0437' | = Georgian | '040E' | = Hungarian
> '0400' | = Process default | '0438' | = Faeroese | '040F' | = Icelandic
> '0401' | = Arabic | '0439' | = Hindi | '041A' | = Croato-Serbian (Latin)
> '0402' | = Bulgarian | '0440' | = Kyrgyz | '041B' | = Slovak
> '0403' | = Catalan | '0441' | = Swahili | '041C' | = Albanian
> '0404' | = Chinese (Traditional) | '0443' | = Uzbek | '041D' | = Swedish
> '0405' | = Czech | '0444' | = Tatar | '041E' | = Thai
> '0406' | = Danish | '0445' | = Bengali | '041F' | = Turkish
> '0407' | = German | '0446' | = Punjabi | '042a' | = Vietnamese
> '0408' | = Greek | '0447' | = Gujarati | '042b' | = Armenian
> '0409' | = English (U.S.) | '0448' | = Oriya | '042c' | = Azeri
> '0410' | = Italian | '0449' | = Tamil | '042d' | = Basque
> '0411' | = Japanese | '0450' | = Mongolian | '042e' | = Sorbian
> '0412' | = Korean | '0456' | = Galician | '042f' | = Macedonian
> '0413' | = Dutch | '0457' | = Konkani | '043a' | = Maltese
> '0414' | = Norwegian (Bokml) | '0458' | = Manipuri | '043b' | = Saami
> '0415' | = Polish | '0459' | = Sindhi | '043c' | = Gaelic
> '0416' | = Portuguese (Brazilian) | '0460' | = Kashmiri | '043e' | = Malay
> '0417' | = Rhaeto-Romanic | '0461' | = Nepali | '043f' | = Kazak
> '0418' | = Romanian | '0465' | = Divehi | '044a' | = Telugu
> '0419' | = Russian | '0490' | = Walon | '044b' | = Kannada
> '0420' | = Urdu | '0491' | = Cornish | '044c' | = Malayalam
> '0421' | = Indonesian | '0492' | = Welsh | '044d' | = Assamese
> '0422' | = Ukrainian | '0493' | = Breton | '044e' | = Marathi
> '0423' | = Belarusian | '0800' | = Neutral 2 | '044f' | = Sanskrit
> '0424' | = Slovenian | '0804' | = Chinese (Simplified) | '045a' | = Syriac
> '0425' | = Estonian | '0807' | = German (Swiss) | '047f' | = Invariant
> '0426' | = Latvian | '0809' | = English (British) | '048f' | = Esperanto
> '0427' | = Lithuanian | '0810' | = Italian (Swiss) | '080A' | = Spanish (Mexican)
> '0428' | = Maori | '0813' | = Dutch (Belgian) | '080C' | = French (Belgian)
> '0429' | = Farsi | '0814' | = Norwegian (Nynorsk) | '081A' | = Serbo-Croatian (Cyrillic)
> '0430' | = Sutu | '0816' | = Portuguese | '0C07' | = German (Austrian)
> '0431' | = Tsonga | '1009' | = English (Canadian) | '0C09' | = English (Australian)
> '0432' | = Tswana | '007F' | = Invariant | '0C0A' | = Spanish (Modern)
> '0433' | = Venda | '040A' | = Spanish (Castilian) | '0C0C' | = French (Canadian)
> '0434' | = Xhosa | '040B' | = Finnish | '100C' | = French (Swiss)
> '0435' | = Zulu | '040C' | = French |  |
> '0436' | = Afrikaans | '040D' | = Hebrew |  |

## EXE DebugRSDS Tags

CodeView RSDS debug information found in some Windows EXE files.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | PDBModifyDate | no | (Taken from debug directory entry pointing to RSDS record.)
> 20 | PDBAge | no |
> 24 | PDBFileName | no |

## EXE DebugNB10 Tags

CodeView NB10 debug information found in some Windows EXE files.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | PDBModifyDate | no | (Taken from debug directory entry pointing to NB10 record.)
> 8 | PDBCreateDate | no |
> 12 | PDBAge | no |
> 16 | PDBFileName | no |

## EXE Misc Tags

Miscellaneous CodeView debug information in Windows EXE files.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 12 | EXEFileName | no |

## EXE MachO Tags

Information extracted from Mach-O (Mac OS X) executable files and DYLIB libraries.

> Index | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | CPUArchitecture | no |
> 1 | CPUByteOrder | no |
> 2 | CPUCount | no |

> 3

> CPUType

> no+

> -1 = Any 1 = VAX 2 = ROMP 4 = NS32032 5 = NS32332 6 = MC680x0 7 = x86 8 = MIPS 9 = NS32532 10 = MC98000 |  | 11 = HPPA 12 = ARM 13 = MC88000 14 = SPARC 15 = i860 big endian 16 = i860 little endian 17 = RS6000 18 = PowerPC 255 = VEO

> 4

> CPUSubtype

> no+

> '1 0' = VAX (all)
> '1 1' = VAX780
> '1 2' = VAX785
> '1 3' = VAX750
> '1 4' = VAX730
> '1 5' = UVAXI
> '1 6' = UVAXII
> '1 7' = VAX8200
> '1 8' = VAX8500
> '1 9' = VAX8600
> '1 10' = VAX8650
> '1 11' = VAX8800
> '1 12' = UVAXIII
> '2 0' = RT (all)
> '2 1' = RT PC
> '2 2' = RT APC
> '2 3' = RT 135
> '4 0' = NS32032 (all)
> '4 1' = NS32032 DPC (032 CPU)
> '4 2' = NS32032 SQT
> '4 3' = NS32032 APC FPU (32081)
> '4 4' = NS32032 APC FPA (Weitek)
> '4 5' = NS32032 XPC (532)
> '5 0' = NS32332 (all)
> '5 1' = NS32332 DPC (032 CPU)
> '5 2' = NS32332 SQT
> '5 3' = NS32332 APC FPU (32081)
> '5 4' = NS32332 APC FPA (Weitek)
> '5 5' = NS32332 XPC (532)
> '6 1' = MC680x0 (all)
> '6 2' = MC68040
> '6 3' = MC68030
> '7 3' = i386 (all)
> '7 4' = i486
> '7 5' = i586
> '7 8' = Pentium III
> '7 9' = Pentium M
> '7 10' = Pentium 4
> '7 11' = Itanium
> '7 12' = Xeon
> '7 22' = Pentium Pro
> '7 24' = Pentium III M
> '7 26' = Pentium 4 M
> '7 27' = Itanium 2
> '7 28' = Xeon MP
> '7 40' = Pentium III Xeon
> '7 54' = Pentium II M3
> '7 86' = Pentium II M5
> '7 103' = Celeron
> '7 119' = Celeron Mobile
> '7 132' = i486SX
> '8 0' = MIPS (all)
> '8 1' = MIPS R2300
> '8 2' = MIPS R2600
> '8 3' = MIPS R2800
> '8 4' = MIPS R2000a
> '8 5' = MIPS R2000
> '8 6' = MIPS R3000a
> '8 7' = MIPS R3000
> '10 0' = MC98000 (all)
> '10 1' = MC98601
> '11 0' = HPPA (all)
> '11 1' = HPPA 7100LC
> '12 0' = ARM (all)
> '12 1' = ARM A500 ARCH
> '12 2' = ARM A500
> '12 3' = ARM A440
> '12 4' = ARM M4
> '12 5' = ARM A680/V4T
> '12 6' = ARM V6
> '12 7' = ARM V5TEJ
> '12 8' = ARM XSCALE
> '12 9' = ARM V7
> '13 0' = MC88000 (all)
> '13 1' = MC88100
> '13 2' = MC88110
> '14 0' = SPARC (all)
> '14 1' = SUN 4/260
> '14 2' = SUN 4/110
> '15 0' = i860 (all)
> '15 1' = i860 860
> '16 0' = i860 little (all)
> '16 1' = i860 little
> '17 0' = RS6000 (all)
> '17 1' = RS6000
> '18 0' = PowerPC (all)
> '18 1' = PowerPC 601
> '18 2' = PowerPC 602
> '18 3' = PowerPC 603
> '18 4' = PowerPC 603e
> '18 5' = PowerPC 603ev
> '18 6' = PowerPC 604
> '18 7' = PowerPC 604e
> '18 8' = PowerPC 620
> '18 9' = PowerPC 750
> '18 10' = PowerPC 7400
> '18 11' = PowerPC 7450
> '18 100' = PowerPC 970
> '255 1' = VEO 1
> '255 2' = VEO 2

> 5

> ObjectFileType

> no

> -1 = Static library 0x1 = Relocatable object 0x2 = Demand paged executable 0x3 = Fixed VM shared library 0x4 = Core 0x5 = Preloaded executable 0x6 = Dynamically bound shared library 0x7 = Dynamic link editor 0x8 = Dynamically bound bundle 0x9 = Shared library stub for static linking 0xa = Debug information 0xb = x86_64 kexts

> 6

> ObjectFlags

> no

> Bit 0 = No undefs
> Bit 1 = Incrementa link
> Bit 2 = Dyld link
> Bit 3 = Bind at load
> Bit 4 = Prebound
> Bit 5 = Split segs
> Bit 6 = Lazy init
> Bit 7 = Two level
> Bit 8 = Force flat
> Bit 9 = No multi defs
> Bit 10 = No fix prebinding
> Bit 11 = Prebindable
> Bit 12 = All mods bound
> Bit 13 = Subsections via symbols
> Bit 14 = Canonical
> Bit 15 = Weak defines
> Bit 16 = Binds to weak
> Bit 17 = Allow stack execution
> Bit 18 = Dead strippable dylib
> Bit 19 = Root safe
> Bit 20 = No reexported dylibs
> Bit 21 = Random address

## EXE PEF Tags

Information extracted from PEF (Classic MacOS) executable files and libraries.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | CPUArchitecture | no | 'm68k' = 68000 'pwpc' = PowerPC
> 3 | PEFVersion | no |
> 4 | TimeStamp | no |

## EXE ELF Tags

Information extracted from ELF (Unix) executable files and SO libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 4 | CPUArchitecture | no | 1 = 32 bit 2 = 64 bit
> 5 | CPUByteOrder | no | 1 = Little endian 2 = Big endian
> 16 | ObjectFileType | no | 0 = None 1 = Relocatable file 2 = Executable file 3 = Shared object file 4 = Core file

> 18

> CPUType

> no

> 0 = None
> 1 = AT&T WE 32100
> 2 = SPARC
> 3 = i386
> 4 = Motorola 68000
> 5 = Motorola 88000
> 6 = i486
> 7 = i860
> 8 = MIPS R3000
> 9 = IBM System/370
> 10 = MIPS R4000
> 15 = HP PA-RISC
> 18 = Sun v8plus
> 19 = Intel 80960
> 20 = PowerPC
> 21 = PowerPC 64-bit
> 22 = IBM S/390
> 23 = Cell BE SPU
> 36 = NEC V800
> 37 = Fujitsu FR20
> 38 = TRW RH-32
> 39 = Motorola RCE
> 40 = Arm (up to Armv7/AArch32)
> 41 = Digital Alpha
> 42 = SuperH
> 43 = SPARC v9 64-bit
> 44 = Siemens TriCore
> 45 = Argonaut RISC Core
> 46 = Renesas H8/300,300H,H8S
> 47 = Hitachi H8/300H
> 48 = Hitachi H8S
> 49 = Hitachi H8/500
> 50 = HP/Intel IA-64
> 51 = Stanford MIPS-X
> 52 = Motorola ColdFire
> 53 = Motorola M68HC12
> 54 = Fujitsu MMA Multimedia Accelerator
> 55 = Siemens PCP
> 56 = Sony nCPU embedded RISC processor
> 57 = Denso NDR1 microprocessor
> 58 = Motorola Star*Core processor
> 59 = Toyota ME16 processor
> 60 = STMicroelectronics ST100 processor
> 61 = Advanced Logic Corp. TinyJ embedded processor family
> 62 = AMD x86-64
> 63 = Sony DSP Processor
> 64 = Digital Equipment Corp. PDP-10
> 65 = Digital Equipment Corp. PDP-11
> 66 = Siemens FX66 microcontroller
> 67 = STMicroelectronics ST9+ 8/16 bit microcontroller
> 68 = STMicroelectronics ST7 8-bit microcontroller
> 69 = Motorola MC68HC16 Microcontroller
> 70 = Motorola MC68HC11 Microcontroller
> 71 = Motorola MC68HC08 Microcontroller
> 72 = Motorola MC68HC05 Microcontroller
> 73 = Silicon Graphics SVx
> 74 = STMicroelectronics ST19 8-bit microcontroller
> 75 = Digital VAX
> 76 = Axis Communications 32-bit embedded processor
> 77 = Infineon Technologies 32-bit embedded processor
> 78 = Element 14 64-bit DSP Processor
> 79 = LSI Logic 16-bit DSP Processor
> 87 = NEC v850
> 88 = Renesas M32R
> 140 = TMS320C6000 Family
> 175 = MCST Elbrus e2k
> 183 = Arm 64-bits (Armv8/AArch64)
> 220 = Zilog Z80
> 243 = RISC-V
> 247 = Berkeley Packet Filter
> 257 = WDC 65C816
> 21569 = Fujitsu FR-V
> 36902 = Alpha
> 36929 = m32r (old)
> 36992 = v850 (old)
> 41872 = S/390 (old)

## EXE AR Tags

Information extracted from static libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 16 | CreateDate | no |

## EXE CHM Tags

Tags extracted from Microsoft Compiled HTML files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 1 | CHMVersion | no |
> 5 | LanguageCode | no | --> EXE LanguageCode Values

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Jan 25, 2025

<-- ExifTool Tag Names