## EXE Tags

This module extracts information from various types of Windows, MacOS and Unix executable and library files. The first table below lists information extracted from the header of Windows PE (Portable Executable) EXE files and DLL libraries.

> Index2 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---

> 0

> MachineType

> N

> 0x14c = Intel 386 or later, and compatibles
> 0x14d = Intel i860
> 0x162 = MIPS R3000
> 0x166 = MIPS little endian (R4000)
> 0x168 = MIPS R10000
> 0x169 = MIPS little endian WCI v2
> 0x183 = Alpha AXP (old)
> 0x184 = Alpha AXP
> 0x1a2 = Hitachi SH3
> 0x1a3 = Hitachi SH3 DSP
> 0x1a6 = Hitachi SH4
> 0x1a8 = Hitachi SH5
> 0x1c0 = ARM little endian
> 0x1c2 = Thumb
> 0x1d3 = Matsushita AM33
> 0x1f0 = PowerPC little endian
> 0x1f1 = PowerPC with floating point support
> 0x200 = Intel IA64
> 0x266 = MIPS16
> 0x268 = Motorola 68000 series
> 0x284 = Alpha AXP 64-bit
> 0x366 = MIPS with FPU
> 0x466 = MIPS16 with FPU
> 0xebc = EFI Byte Code
> 0x8664 = AMD AMD64
> 0x9041 = Mitsubishi M32R little endian
> 0xc0ee = clr pure MSIL

> 2 | TimeStamp | N |
> 10 | PEType | N | 0x10b = PE32 0x20b = PE32+
> 11 | LinkerVersion | N |
> 12 | CodeSize | N |
> 14 | InitializedDataSize | N |
> 16 | UninitializedDataSize | N |
> 18 | EntryPoint | N |
> 30 | OSVersion | N |
> 32 | ImageVersion | N |
> 34 | SubsystemVersion | N |

> 44

> Subsystem

> N

> 0 = Unknown
> 1 = Native
> 2 = Windows GUI
> 3 = Windows command line
> 5 = OS/2 command line
> 7 = POSIX command line
> 9 = Windows CE GUI
> 10 = EFI application
> 11 = EFI boot service
> 12 = EFI runtime driver
> 13 = EFI ROM
> 14 = XBOX

## EXE PEVersion Tags

Information extracted from the VS_VERSION_INFO structure of Windows PE files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | FileVersionNumber | N |
> 4 | ProductVersionNumber | N |
> 6 | FileFlagsMask | N |

> 7

> FileFlags

> N

> Bit 0 = Debug Bit 1 = Pre-release Bit 2 = Patched |  | Bit 3 = Private build Bit 4 = Info inferred Bit 5 = Special build |

> 8

> FileOS

> N

> 0x1 = Win16
> 0x2 = PM-16
> 0x3 = PM-32
> 0x4 = Win32
> 0x10000 = DOS
> 0x10001 = Windows 16-bit
> 0x10004 = Windows 32-bit
> 0x20000 = OS/2 16-bit
> 0x20002 = OS/2 16-bit PM-16
> 0x30000 = OS/2 32-bit
> 0x30003 = OS/2 32-bit PM-32
> 0x40000 = Windows NT
> 0x40004 = Windows NT 32-bit

> 9

> ObjectFileType

> N

> 0 = Unknown
> 1 = Executable application
> 2 = Dynamic link library
> 3 = Driver
> 4 = Font
> 5 = VxD
> 7 = Static library

> 10 | FileSubtype | N |

## EXE PEString Tags

Resource strings found in Windows PE files. The TagID's are not shown because they are the same as the Tag Name. ExifTool will extract any existing StringFileInfo tags even if not listed in this table.

> Tag Name | Writable | Values / Notes
> --- | --- | ---
> BuildDate | N |
> BuildVersion | N |

> CharacterSet

> N

> (extracted from the StringFileInfo value)

> '0000' = ASCII
> '03A4' = Windows, Japan (Shift - JIS X-0208)
> '03A8' = Windows, Chinese (Simplified)
> '03B5' = Windows, Korea (Shift - KSC 5601)
> '03B6' = Windows, Taiwan (Big5)
> '04B0' = Unicode
> '04E2' = Windows, Latin2 (Eastern European)
> '04E3' = Windows, Cyrillic
> '04E4' = Windows, Latin1
> '04E5' = Windows, Greek
> '04E6' = Windows, Turkish
> '04E7' = Windows, Hebrew
> '04E8' = Windows, Arabic

> Comments | N |
> CompanyName | N |
> Copyright | N |
> FileDescription | N |
> FileVersion | N |
> InternalName | N |
> LanguageCode | N | --> EXE LanguageCode Values (extracted from the StringFileInfo value)
> LegalCopyright | N |
> LegalTrademarks | N |
> OriginalFilename | N |
> PrivateBuild | N |
> ProductName | N |
> ProductVersion | N |
> SpecialBuild | N |

## EXE LanguageCode Values

> Value | LanguageCode | Value | LanguageCode | Value | LanguageCode
> --- | --- | --- | --- | --- | ---
> '0000' | = Neutral | '0437' | = Georgian | '040E' | = Hungarian
> '0400' | = Process default | '0438' | = Faeroese | '040F' | = Icelandic
> '0401' | = Arabic | '0439' | = Hindi | '041A' | = Croato-Serbian (Latin)
> '0402' | = Bulgarian | '0440' | = Kyrgyz | '041B' | = Slovak
> '0403' | = Catalan | '0441' | = Swahili | '041C' | = Albanian
> '0404' | = Chinese (Traditional) | '0443' | = Uzbek | '041D' | = Swedish
> '0405' | = Czech | '0444' | = Tatar | '041E' | = Thai
> '0406' | = Danish | '0445' | = Bengali | '041F' | = Turkish
> '0407' | = German | '0446' | = Punjabi | '042a' | = Vietnamese
> '0408' | = Greek | '0447' | = Gujarati | '042b' | = Armenian
> '0409' | = English (U.S.) | '0448' | = Oriya | '042c' | = Azeri
> '0410' | = Italian | '0449' | = Tamil | '042d' | = Basque
> '0411' | = Japanese | '0450' | = Mongolian | '042e' | = Sorbian
> '0412' | = Korean | '0456' | = Galician | '042f' | = Macedonian
> '0413' | = Dutch | '0457' | = Konkani | '043a' | = Maltese
> '0414' | = Norwegian (Bokml) | '0458' | = Manipuri | '043b' | = Saami
> '0415' | = Polish | '0459' | = Sindhi | '043c' | = Gaelic
> '0416' | = Portuguese (Brazilian) | '0460' | = Kashmiri | '043e' | = Malay
> '0417' | = Rhaeto-Romanic | '0461' | = Nepali | '043f' | = Kazak
> '0418' | = Romanian | '0465' | = Divehi | '044a' | = Telugu
> '0419' | = Russian | '0490' | = Walon | '044b' | = Kannada
> '0420' | = Urdu | '0491' | = Cornish | '044c' | = Malayalam
> '0421' | = Indonesian | '0492' | = Welsh | '044d' | = Assamese
> '0422' | = Ukrainian | '0493' | = Breton | '044e' | = Marathi
> '0423' | = Belarusian | '0800' | = Neutral 2 | '044f' | = Sanskrit
> '0424' | = Slovenian | '0804' | = Chinese (Simplified) | '045a' | = Syriac
> '0425' | = Estonian | '0807' | = German (Swiss) | '047f' | = Invariant
> '0426' | = Latvian | '0809' | = English (British) | '048f' | = Esperanto
> '0427' | = Lithuanian | '0810' | = Italian (Swiss) | '080A' | = Spanish (Mexican)
> '0428' | = Maori | '0813' | = Dutch (Belgian) | '080C' | = French (Belgian)
> '0429' | = Farsi | '0814' | = Norwegian (Nynorsk) | '081A' | = Serbo-Croatian (Cyrillic)
> '0430' | = Sutu | '0816' | = Portuguese | '0C07' | = German (Austrian)
> '0431' | = Tsonga | '1009' | = English (Canadian) | '0C09' | = English (Australian)
> '0432' | = Tswana | '007F' | = Invariant | '0C0A' | = Spanish (Modern)
> '0433' | = Venda | '040A' | = Spanish (Castilian) | '0C0C' | = French (Canadian)
> '0434' | = Xhosa | '040B' | = Finnish | '100C' | = French (Swiss)
> '0435' | = Zulu | '040C' | = French |  |
> '0436' | = Afrikaans | '040D' | = Hebrew |  |

## EXE MachO Tags

Information extracted from Mach-O (Mac OS X) executable files and DYLIB libraries.

> Index | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0 | CPUArchitecture | N |
> 1 | CPUByteOrder | N |
> 2 | CPUCount | N |

> 3

> CPUType

> N+

> -1 = Any
> 1 = VAX
> 2 = ROMP
> 4 = NS32032
> 5 = NS32332
> 6 = MC680x0
> 7 = x86
> 8 = MIPS
> 9 = NS32532
> 10 = MC98000

> 11 = HPPA
> 12 = ARM
> 13 = MC88000
> 14 = SPARC
> 15 = i860 big endian
> 16 = i860 little endian
> 17 = RS6000
> 18 = PowerPC
> 255 = VEO

> 4

> CPUSubtype

> N+

> '1 0' = VAX (all)
> '1 1' = VAX780
> '1 2' = VAX785
> '1 3' = VAX750
> '1 4' = VAX730
> '1 5' = UVAXI
> '1 6' = UVAXII
> '1 7' = VAX8200
> '1 8' = VAX8500
> '1 9' = VAX8600
> '1 10' = VAX8650
> '1 11' = VAX8800
> '1 12' = UVAXIII
> '2 0' = RT (all)
> '2 1' = RT PC
> '2 2' = RT APC
> '2 3' = RT 135
> '4 0' = NS32032 (all)
> '4 1' = NS32032 DPC (032 CPU)
> '4 2' = NS32032 SQT
> '4 3' = NS32032 APC FPU (32081)
> '4 4' = NS32032 APC FPA (Weitek)
> '4 5' = NS32032 XPC (532)
> '5 0' = NS32332 (all)
> '5 1' = NS32332 DPC (032 CPU)
> '5 2' = NS32332 SQT
> '5 3' = NS32332 APC FPU (32081)
> '5 4' = NS32332 APC FPA (Weitek)
> '5 5' = NS32332 XPC (532)
> '6 1' = MC680x0 (all)
> '6 2' = MC68040
> '6 3' = MC68030
> '7 3' = i386 (all)
> '7 4' = i486
> '7 5' = i586
> '7 8' = Pentium III
> '7 9' = Pentium M
> '7 10' = Pentium 4
> '7 11' = Itanium
> '7 12' = Xeon
> '7 22' = Pentium Pro
> '7 24' = Pentium III M
> '7 26' = Pentium 4 M
> '7 27' = Itanium 2
> '7 28' = Xeon MP
> '7 40' = Pentium III Xeon
> '7 54' = Pentium II M3
> '7 86' = Pentium II M5
> '7 103' = Celeron
> '7 119' = Celeron Mobile
> '7 132' = i486SX
> '8 0' = MIPS (all)
> '8 1' = MIPS R2300
> '8 2' = MIPS R2600
> '8 3' = MIPS R2800
> '8 4' = MIPS R2000a
> '8 5' = MIPS R2000
> '8 6' = MIPS R3000a
> '8 7' = MIPS R3000
> '10 0' = MC98000 (all)
> '10 1' = MC98601
> '11 0' = HPPA (all)
> '11 1' = HPPA 7100LC
> '12 0' = ARM (all)
> '12 1' = ARM A500 ARCH
> '12 2' = ARM A500
> '12 3' = ARM A440
> '12 4' = ARM M4
> '12 5' = ARM A680/V4T
> '12 6' = ARM V6
> '12 7' = ARM V5TEJ
> '12 8' = ARM XSCALE
> '12 9' = ARM V7
> '13 0' = MC88000 (all)
> '13 1' = MC88100
> '13 2' = MC88110
> '14 0' = SPARC (all)
> '14 1' = SUN 4/260
> '14 2' = SUN 4/110
> '15 0' = i860 (all)
> '15 1' = i860 860
> '16 0' = i860 little (all)
> '16 1' = i860 little
> '17 0' = RS6000 (all)
> '17 1' = RS6000
> '18 0' = PowerPC (all)
> '18 1' = PowerPC 601
> '18 2' = PowerPC 602
> '18 3' = PowerPC 603
> '18 4' = PowerPC 603e
> '18 5' = PowerPC 603ev
> '18 6' = PowerPC 604
> '18 7' = PowerPC 604e
> '18 8' = PowerPC 620
> '18 9' = PowerPC 750
> '18 10' = PowerPC 7400
> '18 11' = PowerPC 7450
> '18 100' = PowerPC 970
> '255 1' = VEO 1
> '255 2' = VEO 2

> 5

> ObjectFileType

> N

> -1 = Static library
> 0x1 = Relocatable object
> 0x2 = Demand paged executable
> 0x3 = Fixed VM shared library
> 0x4 = Core
> 0x5 = Preloaded executable
> 0x6 = Dynamically bound shared library
> 0x7 = Dynamic link editor
> 0x8 = Dynamically bound bundle
> 0x9 = Shared library stub for static linking

## EXE PEF Tags

Information extracted from PEF (Classic MacOS) executable files and libraries.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 2 | CPUArchitecture | N | 'm68k' = 68000 'pwpc' = PowerPC
> 3 | PEFVersion | N |
> 4 | TimeStamp | N |

## EXE ELF Tags

Information extracted from ELF (Unix) executable files and SO libraries.

> Index1 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 4 | CPUArchitecture | N | 1 = 32 bit 2 = 64 bit
> 5 | CPUByteOrder | N | 1 = Little endian 2 = Big endian
> 16 | ObjectFileType | N | 0 = None 1 = Relocatable file 2 = Executable file 3 = Shared object file 4 = Core file

> 18

> CPUType

> N

> 0 = None
> 1 = AT&T WE 32100
> 2 = SPARC
> 3 = i386
> 4 = Motorola 68000
> 5 = Motorola 88000
> 6 = i486
> 7 = i860
> 8 = MIPS R3000
> 10 = MIPS R4000
> 15 = HPPA
> 18 = Sun v8plus
> 20 = PowerPC
> 21 = PowerPC 64-bit
> 22 = IBM S/390
> 23 = Cell BE SPU
> 42 = SuperH
> 43 = SPARC v9 64-bit
> 46 = Renesas H8/300,300H,H8S
> 50 = HP/Intel IA-64
> 62 = AMD x86-64
> 76 = Axis Communications 32-bit embedded processor
> 87 = NEC v850
> 88 = Renesas M32R
> 21569 = Fujitsu FR-V
> 36902 = Alpha
> 36929 = m32r (old)
> 36992 = v850 (old)
> 41872 = S/390 (old)

## EXE CHM Tags

Tags extracted from Microsoft Compiled HTML files.

> Index4 | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 1 | CHMVersion | N |
> 5 | LanguageCode | N | --> EXE LanguageCode Values

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Jul 12, 2011

<-- ExifTool Tag Names