## EXE Tags

This module extracts information from various types of Windows, MacOS and Unix executable and library files. The first table below lists information extracted from the header of Windows PE (Portable Executable) EXE files and DLL libraries.

> Index2 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | MachineType | no |
> 0x14c = Intel 386 or later, and compatibles 0x14d = Intel i860 0x162 = MIPS R3000 0x166 = MIPS little endian (R4000) 0x168 = MIPS R10000 0x169 = MIPS little endian WCI v2 0x183 = Alpha AXP (old) 0x184 = Alpha AXP 0x1a2 = Hitachi SH3 0x1a3 = Hitachi SH3 DSP 0x1a6 = Hitachi SH4 0x1a8 = Hitachi SH5 0x1c0 = ARM little endian 0x1c2 = Thumb 0x1d3 = Matsushita AM33 0x1f0 = PowerPC little endian 0x1f1 = PowerPC with floating point support 0x200 = Intel IA64 0x266 = MIPS16 0x268 = Motorola 68000 series 0x284 = Alpha AXP 64-bit 0x366 = MIPS with FPU 0x466 = MIPS16 with FPU 0xebc = EFI Byte Code 0x8664 = AMD AMD64 0x9041 = Mitsubishi M32R little endian 0xc0ee = clr pure MSIL
> 2 | TimeStamp | no |
> 9 | ImageFileCharacteristics | no |
> Bit 0 = No relocs Bit 1 = Executable Bit 2 = No line numbers Bit 3 = No symbols Bit 4 = Aggressive working-set trim Bit 5 = Large address aware Bit 7 = Bytes reversed lo Bit 8 = 32-bit Bit 9 = No debug Bit 10 = Removable run from swap Bit 11 = Net run from swap Bit 12 = System file Bit 13 = DLL Bit 14 = Uniprocessor only Bit 15 = Bytes reversed hi
> 10 | PEType | no | 0x107 = ROM Image 0x10b = PE32 0x20b = PE32+
> 11 | LinkerVersion | no |
> 12 | CodeSize | no |
> 14 | InitializedDataSize | no |
> 16 | UninitializedDataSize | no |
> 18 | EntryPoint | no |
> 30 | OSVersion | no |
> 32 | ImageVersion | no |
> 34 | SubsystemVersion | no |
> 44 | Subsystem | no |
> 0 = Unknown 1 = Native 2 = Windows GUI 3 = Windows command line 5 = OS/2 command line 7 = POSIX command line 9 = Windows CE GUI 10 = EFI application 11 = EFI boot service 12 = EFI runtime driver 13 = EFI ROM 14 = XBOX

## EXE PEVersion Tags

Information extracted from the VS_VERSION_INFO structure of Windows PE files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | FileVersionNumber | no |
> 4 | ProductVersionNumber | no |
> 6 | FileFlagsMask | no |
> 7 | FileFlags | no |
> Bit 0 = Debug Bit 1 = Pre-release Bit 2 = Patched |  | Bit 3 = Private build Bit 4 = Info inferred Bit 5 = Special build
> 8 | FileOS | no |
> 0x1 = Win16 0x2 = PM-16 0x3 = PM-32 0x4 = Win32 0x10000 = DOS 0x10001 = Windows 16-bit 0x10004 = Windows 32-bit 0x20000 = OS/2 16-bit 0x20002 = OS/2 16-bit PM-16 0x30000 = OS/2 32-bit 0x30003 = OS/2 32-bit PM-32 0x40000 = Windows NT 0x40004 = Windows NT 32-bit
> 9 | ObjectFileType | no |
> 0 = Unknown 1 = Executable application 2 = Dynamic link library 3 = Driver 4 = Font 5 = VxD 7 = Static library
> 10 | FileSubtype | no |

## EXE PEString Tags

Resource strings found in Windows PE files. The TagID's are not shown because they are the same as the Tag Name. ExifTool will extract any existing StringFileInfo tags even if not listed in this table.

> Tag Name | Writable | Values / Notes
> --- | --- | ---
> BuildDate | no |
> BuildVersion | no |
> CharacterSet | no | (extracted from the StringFileInfo value)
> '0000' = ASCII '03A4' = Windows, Japan (Shift - JIS X-0208) '03A8' = Windows, Chinese (Simplified) '03B5' = Windows, Korea (Shift - KSC 5601) '03B6' = Windows, Taiwan (Big5) '04B0' = Unicode '04E2' = Windows, Latin2 (Eastern European) '04E3' = Windows, Cyrillic '04E4' = Windows, Latin1 '04E5' = Windows, Greek '04E6' = Windows, Turkish '04E7' = Windows, Hebrew '04E8' = Windows, Arabic
> Comments | no |
> CompanyName | no |
> Copyright | no |
> FileDescription | no |
> FileVersion | no |
> InternalName | no |
> LanguageCode | no | --> EXE LanguageCode Values (Windows code page; extracted from the StringFileInfo value)
> LegalCopyright | no |
> LegalTrademarks | no |
> OriginalFileName | no |
> PrivateBuild | no |
> ProductName | no |
> ProductVersion | no |
> SpecialBuild | no |

## EXE LanguageCode Values

See https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid for the full list of Microsoft language codes.

> Value | LanguageCode | Value | LanguageCode | Value | LanguageCode
> --- | --- | --- | --- | --- | ---
> '0000' | = Neutral | '0437' | = Georgian | '040E' | = Hungarian
> '0400' | = Process default | '0438' | = Faeroese | '040F' | = Icelandic
> '0401' | = Arabic | '0439' | = Hindi | '041A' | = Croato-Serbian (Latin)
> '0402' | = Bulgarian | '0440' | = Kyrgyz | '041B' | = Slovak
> '0403' | = Catalan | '0441' | = Swahili | '041C' | = Albanian
> '0404' | = Chinese (Traditional) | '0443' | = Uzbek | '041D' | = Swedish
> '0405' | = Czech | '0444' | = Tatar | '041E' | = Thai
> '0406' | = Danish | '0445' | = Bengali | '041F' | = Turkish
> '0407' | = German | '0446' | = Punjabi | '042a' | = Vietnamese
> '0408' | = Greek | '0447' | = Gujarati | '042b' | = Armenian
> '0409' | = English (U.S.) | '0448' | = Oriya | '042c' | = Azeri
> '0410' | = Italian | '0449' | = Tamil | '042d' | = Basque
> '0411' | = Japanese | '0450' | = Mongolian | '042e' | = Sorbian
> '0412' | = Korean | '0456' | = Galician | '042f' | = Macedonian
> '0413' | = Dutch | '0457' | = Konkani | '043a' | = Maltese
> '0414' | = Norwegian (Bokml) | '0458' | = Manipuri | '043b' | = Saami
> '0415' | = Polish | '0459' | = Sindhi | '043c' | = Gaelic
> '0416' | = Portuguese (Brazilian) | '0460' | = Kashmiri | '043e' | = Malay
> '0417' | = Rhaeto-Romanic | '0461' | = Nepali | '043f' | = Kazak
> '0418' | = Romanian | '0465' | = Divehi | '044a' | = Telugu
> '0419' | = Russian | '0490' | = Walon | '044b' | = Kannada
> '0420' | = Urdu | '0491' | = Cornish | '044c' | = Malayalam
> '0421' | = Indonesian | '0492' | = Welsh | '044d' | = Assamese
> '0422' | = Ukrainian | '0493' | = Breton | '044e' | = Marathi
> '0423' | = Belarusian | '0800' | = Neutral 2 | '044f' | = Sanskrit
> '0424' | = Slovenian | '0804' | = Chinese (Simplified) | '045a' | = Syriac
> '0425' | = Estonian | '0807' | = German (Swiss) | '047f' | = Invariant
> '0426' | = Latvian | '0809' | = English (British) | '048f' | = Esperanto
> '0427' | = Lithuanian | '0810' | = Italian (Swiss) | '080A' | = Spanish (Mexican)
> '0428' | = Maori | '0813' | = Dutch (Belgian) | '080C' | = French (Belgian)
> '0429' | = Farsi | '0814' | = Norwegian (Nynorsk) | '081A' | = Serbo-Croatian (Cyrillic)
> '0430' | = Sutu | '0816' | = Portuguese | '0C07' | = German (Austrian)
> '0431' | = Tsonga | '1009' | = English (Canadian) | '0C09' | = English (Australian)
> '0432' | = Tswana | '007F' | = Invariant | '0C0A' | = Spanish (Modern)
> '0433' | = Venda | '040A' | = Spanish (Castilian) | '0C0C' | = French (Canadian)
> '0434' | = Xhosa | '040B' | = Finnish | '100C' | = French (Swiss)
> '0435' | = Zulu | '040C' | = French |  |
> '0436' | = Afrikaans | '040D' | = Hebrew |  |

## EXE MachO Tags

Information extracted from Mach-O (Mac OS X) executable files and DYLIB libraries.

> Index | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | CPUArchitecture | no |
> 1 | CPUByteOrder | no |
> 2 | CPUCount | no |
> 3 | CPUType | no+ |
> -1 = Any 1 = VAX 2 = ROMP 4 = NS32032 5 = NS32332 6 = MC680x0 7 = x86 8 = MIPS 9 = NS32532 10 = MC98000 |  | 11 = HPPA 12 = ARM 13 = MC88000 14 = SPARC 15 = i860 big endian 16 = i860 little endian 17 = RS6000 18 = PowerPC 255 = VEO
> 4 | CPUSubtype | no+ |
> '1 0' = VAX (all) '1 1' = VAX780 '1 2' = VAX785 '1 3' = VAX750 '1 4' = VAX730 '1 5' = UVAXI '1 6' = UVAXII '1 7' = VAX8200 '1 8' = VAX8500 '1 9' = VAX8600 '1 10' = VAX8650 '1 11' = VAX8800 '1 12' = UVAXIII '2 0' = RT (all) '2 1' = RT PC '2 2' = RT APC '2 3' = RT 135 '4 0' = NS32032 (all) '4 1' = NS32032 DPC (032 CPU) '4 2' = NS32032 SQT '4 3' = NS32032 APC FPU (32081) '4 4' = NS32032 APC FPA (Weitek) '4 5' = NS32032 XPC (532) '5 0' = NS32332 (all) '5 1' = NS32332 DPC (032 CPU) '5 2' = NS32332 SQT '5 3' = NS32332 APC FPU (32081) '5 4' = NS32332 APC FPA (Weitek) '5 5' = NS32332 XPC (532) '6 1' = MC680x0 (all) '6 2' = MC68040 '6 3' = MC68030 '7 3' = i386 (all) '7 4' = i486 '7 5' = i586 '7 8' = Pentium III '7 9' = Pentium M '7 10' = Pentium 4 '7 11' = Itanium '7 12' = Xeon '7 22' = Pentium Pro '7 24' = Pentium III M '7 26' = Pentium 4 M '7 27' = Itanium 2 '7 28' = Xeon MP '7 40' = Pentium III Xeon '7 54' = Pentium II M3 '7 86' = Pentium II M5 '7 103' = Celeron '7 119' = Celeron Mobile '7 132' = i486SX '8 0' = MIPS (all) '8 1' = MIPS R2300 '8 2' = MIPS R2600 '8 3' = MIPS R2800 '8 4' = MIPS R2000a '8 5' = MIPS R2000 '8 6' = MIPS R3000a '8 7' = MIPS R3000 '10 0' = MC98000 (all) '10 1' = MC98601 '11 0' = HPPA (all) '11 1' = HPPA 7100LC '12 0' = ARM (all) '12 1' = ARM A500 ARCH '12 2' = ARM A500 '12 3' = ARM A440 '12 4' = ARM M4 '12 5' = ARM A680/V4T '12 6' = ARM V6 '12 7' = ARM V5TEJ '12 8' = ARM XSCALE '12 9' = ARM V7 '13 0' = MC88000 (all) '13 1' = MC88100 '13 2' = MC88110 '14 0' = SPARC (all) '14 1' = SUN 4/260 '14 2' = SUN 4/110 '15 0' = i860 (all) '15 1' = i860 860 '16 0' = i860 little (all) '16 1' = i860 little '17 0' = RS6000 (all) '17 1' = RS6000 '18 0' = PowerPC (all) '18 1' = PowerPC 601 '18 2' = PowerPC 602 '18 3' = PowerPC 603 '18 4' = PowerPC 603e '18 5' = PowerPC 603ev '18 6' = PowerPC 604 '18 7' = PowerPC 604e '18 8' = PowerPC 620 '18 9' = PowerPC 750 '18 10' = PowerPC 7400 '18 11' = PowerPC 7450 '18 100' = PowerPC 970 '255 1' = VEO 1 '255 2' = VEO 2
> 5 | ObjectFileType | no |
> -1 = Static library 0x1 = Relocatable object 0x2 = Demand paged executable 0x3 = Fixed VM shared library 0x4 = Core 0x5 = Preloaded executable 0x6 = Dynamically bound shared library 0x7 = Dynamic link editor 0x8 = Dynamically bound bundle 0x9 = Shared library stub for static linking 0xa = Debug information 0xb = x86_64 kexts
> 6 | ObjectFlags | no |
> Bit 0 = No undefs Bit 1 = Incrementa link Bit 2 = Dyld link Bit 3 = Bind at load Bit 4 = Prebound Bit 5 = Split segs Bit 6 = Lazy init Bit 7 = Two level Bit 8 = Force flat Bit 9 = No multi defs Bit 10 = No fix prebinding Bit 11 = Prebindable Bit 12 = All mods bound Bit 13 = Subsections via symbols Bit 14 = Canonical Bit 15 = Weak defines Bit 16 = Binds to weak Bit 17 = Allow stack execution Bit 18 = Dead strippable dylib Bit 19 = Root safe Bit 20 = No reexported dylibs Bit 21 = Random address

## EXE PEF Tags

Information extracted from PEF (Classic MacOS) executable files and libraries.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | CPUArchitecture | no | 'm68k' = 68000 'pwpc' = PowerPC
> 3 | PEFVersion | no |
> 4 | TimeStamp | no |

## EXE ELF Tags

Information extracted from ELF (Unix) executable files and SO libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 4 | CPUArchitecture | no | 1 = 32 bit 2 = 64 bit
> 5 | CPUByteOrder | no | 1 = Little endian 2 = Big endian
> 16 | ObjectFileType | no | 0 = None 1 = Relocatable file 2 = Executable file 3 = Shared object file 4 = Core file
> 18 | CPUType | no | 0 = None 1 = AT&T WE 32100 2 = SPARC 3 = i386 4 = Motorola 68000 5 = Motorola 88000 6 = i486 7 = i860 8 = MIPS R3000 10 = MIPS R4000 15 = HPPA 18 = Sun v8plus 20 = PowerPC 21 = PowerPC 64-bit 22 = IBM S/390 23 = Cell BE SPU 42 = SuperH 43 = SPARC v9 64-bit 46 = Renesas H8/300,300H,H8S 50 = HP/Intel IA-64 62 = AMD x86-64 76 = Axis Communications 32-bit embedded processor 87 = NEC v850 88 = Renesas M32R 21569 = Fujitsu FR-V 36902 = Alpha 36929 = m32r (old) 36992 = v850 (old) 41872 = S/390 (old)

## EXE AR Tags

Information extracted from static libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 16 | CreateDate | no |

## EXE CHM Tags

Tags extracted from Microsoft Compiled HTML files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 1 | CHMVersion | no |
> 5 | LanguageCode | no | --> EXE LanguageCode Values

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Mar 19, 2020

<-- ExifTool Tag Names