EXE Tags
This module extracts information from various types of Windows, MacOS and
Unix executable and library files.  The first table below lists information
extracted from the header of Windows PE (Portable Executable) EXE files and
DLL libraries.
| 
| Index2 | Tag Name | Writable | Values / Notes | 
|---|
 
| 0 | MachineType | no | 
  | 0x0 = Unknown 0x1 = Target host
 0x14c = Intel 386 or later, and compatibles
 0x14d = Intel i860
 0x162 = MIPS R3000
 0x166 = MIPS little endian (R4000)
 0x168 = MIPS R10000
 0x169 = MIPS little endian WCI v2
 0x183 = Alpha AXP (old)
 0x184 = Alpha AXP
 0x1a2 = Hitachi SH3
 0x1a3 = Hitachi SH3 DSP
 0x1a4 = Hitachi SH3E
 0x1a6 = Hitachi SH4
 0x1a8 = Hitachi SH5
 0x1c0 = ARM little endian
 0x1c2 = Thumb
 0x1c4 = Thumb 2 little endian
 0x1d3 = Matsushita AM33
 0x1f0 = PowerPC little endian
 0x1f1 = PowerPC with floating point support
 0x200 = Intel IA64
 0x266 = MIPS16
 0x268 = Motorola 68000 series
 0x284 = Alpha AXP 64-bit
 0x366 = MIPS with FPU
 0x466 = MIPS16 with FPU
 0x520 = Infineon Tricore
 0xcef = CEF
 0xebc = EFI Byte Code
 0x3a64 = Compiled Hybrid PE
 0x5032 = RISC-V 32-bit
 0x5064 = RISC-V 64-bit
 0x5128 = RISC-V 128-bit
 0x6232 = LoongArch 32-bit
 0x6264 = LoongArch 64-bit
 0x8664 = AMD AMD64
 0x9041 = Mitsubishi M32R little endian
 0xaa64 = ARM64 little endian
 0xc0ee = clr pure MSIL
 0xec20 = Dotnet 0xEC20
 | 
 |  
| 2 | TimeStamp | no |  |  
| 9 | ImageFileCharacteristics | no | 
  | Bit 0 = No relocs Bit 1 = Executable
 Bit 2 = No line numbers
 Bit 3 = No symbols
 Bit 4 = Aggressive working-set trim
 Bit 5 = Large address aware
 Bit 7 = Bytes reversed lo
 Bit 8 = 32-bit
 Bit 9 = No debug
 Bit 10 = Removable run from swap
 Bit 11 = Net run from swap
 Bit 12 = System file
 Bit 13 = DLL
 Bit 14 = Uniprocessor only
 Bit 15 = Bytes reversed hi
 | 
 |  
| 10 | PEType | no | 0x107 = ROM Image 0x10b = PE32
 0x20b = PE32+
 |  
| 11 | LinkerVersion | no |  |  
| 12 | CodeSize | no |  |  
| 14 | InitializedDataSize | no |  |  
| 16 | UninitializedDataSize | no |  |  
| 18 | EntryPoint | no |  |  
| 30 | OSVersion | no |  |  
| 32 | ImageVersion | no |  |  
| 34 | SubsystemVersion | no |  |  
| 44 | Subsystem | no | 
  | 0 = Unknown 1 = Native
 2 = Windows GUI
 3 = Windows command line
 5 = OS/2 command line
 7 = POSIX command line
 9 = Windows CE GUI
 10 = EFI application
 11 = EFI boot service
 12 = EFI runtime driver
 13 = EFI ROM
 14 = XBOX
 | 
 |  | 
Information extracted from the VS_VERSION_INFO structure of Windows PE
files.
| 
| Index4 | Tag Name | Writable | Values / Notes | 
|---|
 
| 2 | FileVersionNumber | no |  |  
| 4 | ProductVersionNumber | no |  |  
| 6 | FileFlagsMask | no |  |  
| 7 | FileFlags | no | 
  | Bit 0 = Debug Bit 1 = Pre-release
 Bit 2 = Patched
 |  | Bit 3 = Private build Bit 4 = Info inferred
 Bit 5 = Special build
 | 
 |  
| 8 | FileOS | no | 
  | 0x1 = Win16 0x2 = PM-16
 0x3 = PM-32
 0x4 = Win32
 0x10000 = DOS
 0x10001 = Windows 16-bit
 0x10004 = Windows 32-bit
 0x20000 = OS/2 16-bit
 0x20002 = OS/2 16-bit PM-16
 0x30000 = OS/2 32-bit
 0x30003 = OS/2 32-bit PM-32
 0x40000 = Windows NT
 0x40004 = Windows NT 32-bit
 | 
 |  
| 9 | ObjectFileType | no | 
  | 0 = Unknown 1 = Executable application
 2 = Dynamic link library
 3 = Driver
 4 = Font
 5 = VxD
 7 = Static library
 | 
 |  
| 10 | FileSubtype | no |  |  | 
Resource strings found in Windows PE files.  The TagID's are not shown
because they are the same as the Tag Name.  ExifTool will extract any
existing StringFileInfo tags even if not listed in this table.
| 
| Tag Name | Writable | Values / Notes | 
|---|
 
| BuildDate | no |  |  
| BuildVersion | no |  |  
| CharacterSet | no | (extracted from the StringFileInfo value) 
  | '0000' = ASCII '03A4' = Windows, Japan (Shift - JIS X-0208)
 '03A8' = Windows, Chinese (Simplified)
 '03B5' = Windows, Korea (Shift - KSC 5601)
 '03B6' = Windows, Taiwan (Big5)
 '04B0' = Unicode
 '04E2' = Windows, Latin2 (Eastern European)
 '04E3' = Windows, Cyrillic
 '04E4' = Windows, Latin1
 '04E5' = Windows, Greek
 '04E6' = Windows, Turkish
 '04E7' = Windows, Hebrew
 '04E8' = Windows, Arabic
 | 
 |  
| Comments | no |  |  
| CompanyName | no |  |  
| Copyright | no |  |  
| FileDescription | no |  |  
| FileVersion | no |  |  
| InternalName | no |  |  
| LanguageCode | no | --> EXE LanguageCode Values (Windows code page; extracted from the StringFileInfo value)
 |  
| LegalCopyright | no |  |  
| LegalTrademarks | no |  |  
| OriginalFileName | no |  |  
| PrivateBuild | no |  |  
| ProductName | no |  |  
| ProductVersion | no |  |  
| SpecialBuild | no |  |  | 
See https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid
for the full list of Microsoft language codes.
| 
| Value | LanguageCode | Value | LanguageCode | Value | LanguageCode | 
|---|
 | '0000' | = Neutral | '0437' | = Georgian | '040E' | = Hungarian |  | '0400' | = Process default | '0438' | = Faeroese | '040F' | = Icelandic |  | '0401' | = Arabic | '0439' | = Hindi | '041A' | = Croato-Serbian (Latin) |  | '0402' | = Bulgarian | '0440' | = Kyrgyz | '041B' | = Slovak |  | '0403' | = Catalan | '0441' | = Swahili | '041C' | = Albanian |  | '0404' | = Chinese (Traditional) | '0443' | = Uzbek | '041D' | = Swedish |  | '0405' | = Czech | '0444' | = Tatar | '041E' | = Thai |  | '0406' | = Danish | '0445' | = Bengali | '041F' | = Turkish |  | '0407' | = German | '0446' | = Punjabi | '042a' | = Vietnamese |  | '0408' | = Greek | '0447' | = Gujarati | '042b' | = Armenian |  | '0409' | = English (U.S.) | '0448' | = Oriya | '042c' | = Azeri |  | '0410' | = Italian | '0449' | = Tamil | '042d' | = Basque |  | '0411' | = Japanese | '0450' | = Mongolian | '042e' | = Sorbian |  | '0412' | = Korean | '0456' | = Galician | '042f' | = Macedonian |  | '0413' | = Dutch | '0457' | = Konkani | '043a' | = Maltese |  | '0414' | = Norwegian (Bokml) | '0458' | = Manipuri | '043b' | = Saami |  | '0415' | = Polish | '0459' | = Sindhi | '043c' | = Gaelic |  | '0416' | = Portuguese (Brazilian) | '0460' | = Kashmiri | '043e' | = Malay |  | '0417' | = Rhaeto-Romanic | '0461' | = Nepali | '043f' | = Kazak |  | '0418' | = Romanian | '0465' | = Divehi | '044a' | = Telugu |  | '0419' | = Russian | '0490' | = Walon | '044b' | = Kannada |  | '0420' | = Urdu | '0491' | = Cornish | '044c' | = Malayalam |  | '0421' | = Indonesian | '0492' | = Welsh | '044d' | = Assamese |  | '0422' | = Ukrainian | '0493' | = Breton | '044e' | = Marathi |  | '0423' | = Belarusian | '0800' | = Neutral 2 | '044f' | = Sanskrit |  | '0424' | = Slovenian | '0804' | = Chinese (Simplified) | '045a' | = Syriac |  | '0425' | = Estonian | '0807' | = German (Swiss) | '047f' | = Invariant |  | '0426' | = Latvian | '0809' | = English (British) | '048f' | = Esperanto |  | '0427' | = Lithuanian | '0810' | = Italian (Swiss) | '080A' | = Spanish (Mexican) |  | '0428' | = Maori | '0813' | = Dutch (Belgian) | '080C' | = French (Belgian) |  | '0429' | = Farsi | '0814' | = Norwegian (Nynorsk) | '081A' | = Serbo-Croatian (Cyrillic) |  | '0430' | = Sutu | '0816' | = Portuguese | '0C07' | = German (Austrian) |  | '0431' | = Tsonga | '1009' | = English (Canadian) | '0C09' | = English (Australian) |  | '0432' | = Tswana | '007F' | = Invariant | '0C0A' | = Spanish (Modern) |  | '0433' | = Venda | '040A' | = Spanish (Castilian) | '0C0C' | = French (Canadian) |  | '0434' | = Xhosa | '040B' | = Finnish | '100C' | = French (Swiss) |  | '0435' | = Zulu | '040C' | = French |  |  |  | '0436' | = Afrikaans | '040D' | = Hebrew |  |  |  | 
CodeView RSDS debug information found in some Windows EXE files.
| 
| Index1 | Tag Name | Writable | Values / Notes | 
|---|
 
| 0 | PDBModifyDate | no | (Taken from debug directory entry pointing to RSDS record.) |  
| 20 | PDBAge | no |  |  
| 24 | PDBFileName | no |  |  | 
CodeView NB10 debug information found in some Windows EXE files.
| 
| Index1 | Tag Name | Writable | Values / Notes | 
|---|
 
| 0 | PDBModifyDate | no | (Taken from debug directory entry pointing to NB10 record.) |  
| 8 | PDBCreateDate | no |  |  
| 12 | PDBAge | no |  |  
| 16 | PDBFileName | no |  |  | 
Miscellaneous CodeView debug information in Windows EXE files.
| 
| Index1 | Tag Name | Writable | Values / Notes | 
|---|
 
| 12 | EXEFileName | no |  |  | 
Information extracted from Mach-O (Mac OS X) executable files and DYLIB
libraries.
| 
| Index | Tag Name | Writable | Values / Notes | 
|---|
 
| 0 | CPUArchitecture | no |  |  
| 1 | CPUByteOrder | no |  |  
| 2 | CPUCount | no |  |  
| 3 | CPUType | no+ | 
  | -1 = Any 1 = VAX
 2 = ROMP
 4 = NS32032
 5 = NS32332
 6 = MC680x0
 7 = x86
 8 = MIPS
 9 = NS32532
 10 = MC98000
 |  | 11 = HPPA 12 = ARM
 13 = MC88000
 14 = SPARC
 15 = i860 big endian
 16 = i860 little endian
 17 = RS6000
 18 = PowerPC
 255 = VEO
 | 
 |  
| 4 | CPUSubtype | no+ | 
  | '1 0' = VAX (all) '1 1' = VAX780
 '1 2' = VAX785
 '1 3' = VAX750
 '1 4' = VAX730
 '1 5' = UVAXI
 '1 6' = UVAXII
 '1 7' = VAX8200
 '1 8' = VAX8500
 '1 9' = VAX8600
 '1 10' = VAX8650
 '1 11' = VAX8800
 '1 12' = UVAXIII
 '2 0' = RT (all)
 '2 1' = RT PC
 '2 2' = RT APC
 '2 3' = RT 135
 '4 0' = NS32032 (all)
 '4 1' = NS32032 DPC (032 CPU)
 '4 2' = NS32032 SQT
 '4 3' = NS32032 APC FPU (32081)
 '4 4' = NS32032 APC FPA (Weitek)
 '4 5' = NS32032 XPC (532)
 '5 0' = NS32332 (all)
 '5 1' = NS32332 DPC (032 CPU)
 '5 2' = NS32332 SQT
 '5 3' = NS32332 APC FPU (32081)
 '5 4' = NS32332 APC FPA (Weitek)
 '5 5' = NS32332 XPC (532)
 '6 1' = MC680x0 (all)
 '6 2' = MC68040
 '6 3' = MC68030
 '7 3' = i386 (all)
 '7 4' = i486
 '7 5' = i586
 '7 8' = Pentium III
 '7 9' = Pentium M
 '7 10' = Pentium 4
 '7 11' = Itanium
 '7 12' = Xeon
 '7 22' = Pentium Pro
 '7 24' = Pentium III M
 '7 26' = Pentium 4 M
 '7 27' = Itanium 2
 '7 28' = Xeon MP
 '7 40' = Pentium III Xeon
 '7 54' = Pentium II M3
 '7 86' = Pentium II M5
 '7 103' = Celeron
 '7 119' = Celeron Mobile
 '7 132' = i486SX
 '8 0' = MIPS (all)
 '8 1' = MIPS R2300
 '8 2' = MIPS R2600
 '8 3' = MIPS R2800
 '8 4' = MIPS R2000a
 '8 5' = MIPS R2000
 '8 6' = MIPS R3000a
 '8 7' = MIPS R3000
 '10 0' = MC98000 (all)
 '10 1' = MC98601
 '11 0' = HPPA (all)
 '11 1' = HPPA 7100LC
 '12 0' = ARM (all)
 '12 1' = ARM A500 ARCH
 '12 2' = ARM A500
 '12 3' = ARM A440
 '12 4' = ARM M4
 '12 5' = ARM A680/V4T
 '12 6' = ARM V6
 '12 7' = ARM V5TEJ
 '12 8' = ARM XSCALE
 '12 9' = ARM V7
 '13 0' = MC88000 (all)
 '13 1' = MC88100
 '13 2' = MC88110
 '14 0' = SPARC (all)
 '14 1' = SUN 4/260
 '14 2' = SUN 4/110
 '15 0' = i860 (all)
 '15 1' = i860 860
 '16 0' = i860 little (all)
 '16 1' = i860 little
 '17 0' = RS6000 (all)
 '17 1' = RS6000
 '18 0' = PowerPC (all)
 '18 1' = PowerPC 601
 '18 2' = PowerPC 602
 '18 3' = PowerPC 603
 '18 4' = PowerPC 603e
 '18 5' = PowerPC 603ev
 '18 6' = PowerPC 604
 '18 7' = PowerPC 604e
 '18 8' = PowerPC 620
 '18 9' = PowerPC 750
 '18 10' = PowerPC 7400
 '18 11' = PowerPC 7450
 '18 100' = PowerPC 970
 '255 1' = VEO 1
 '255 2' = VEO 2
 | 
 |  
| 5 | ObjectFileType | no | 
  | -1 = Static library 0x1 = Relocatable object
 0x2 = Demand paged executable
 0x3 = Fixed VM shared library
 0x4 = Core
 0x5 = Preloaded executable
 0x6 = Dynamically bound shared library
 0x7 = Dynamic link editor
 0x8 = Dynamically bound bundle
 0x9 = Shared library stub for static linking
 0xa = Debug information
 0xb = x86_64 kexts
 | 
 |  
| 6 | ObjectFlags | no | 
  | Bit 0 = No undefs Bit 1 = Incrementa link
 Bit 2 = Dyld link
 Bit 3 = Bind at load
 Bit 4 = Prebound
 Bit 5 = Split segs
 Bit 6 = Lazy init
 Bit 7 = Two level
 Bit 8 = Force flat
 Bit 9 = No multi defs
 Bit 10 = No fix prebinding
 Bit 11 = Prebindable
 Bit 12 = All mods bound
 Bit 13 = Subsections via symbols
 Bit 14 = Canonical
 Bit 15 = Weak defines
 Bit 16 = Binds to weak
 Bit 17 = Allow stack execution
 Bit 18 = Dead strippable dylib
 Bit 19 = Root safe
 Bit 20 = No reexported dylibs
 Bit 21 = Random address
 | 
 |  | 
Information extracted from PEF (Classic MacOS) executable files and
libraries.
| 
| Index4 | Tag Name | Writable | Values / Notes | 
|---|
 
| 2 | CPUArchitecture | no | 'm68k' = 68000 'pwpc' = PowerPC
 |  
| 3 | PEFVersion | no |  |  
| 4 | TimeStamp | no |  |  | 
Information extracted from ELF (Unix) executable files and SO libraries.
| 
| Index1 | Tag Name | Writable | Values / Notes | 
|---|
 
| 4 | CPUArchitecture | no | 1 = 32 bit 2 = 64 bit
 |  
| 5 | CPUByteOrder | no | 1 = Little endian 2 = Big endian
 |  
| 16 | ObjectFileType | no | 0 = None 1 = Relocatable file
 2 = Executable file
 3 = Shared object file
 4 = Core file
 |  
| 18 | CPUType | no | 0 = None 1 = AT&T WE 32100
 2 = SPARC
 3 = i386
 4 = Motorola 68000
 5 = Motorola 88000
 6 = i486
 7 = i860
 8 = MIPS R3000
 9 = IBM System/370
 10 = MIPS R4000
 15 = HP PA-RISC
 18 = Sun v8plus
 19 = Intel 80960
 20 = PowerPC
 21 = PowerPC 64-bit
 22 = IBM S/390
 23 = Cell BE SPU
 36 = NEC V800
 37 = Fujitsu FR20
 38 = TRW RH-32
 39 = Motorola RCE
 40 = Arm (up to Armv7/AArch32)
 41 = Digital Alpha
 42 = SuperH
 43 = SPARC v9 64-bit
 44 = Siemens TriCore
 45 = Argonaut RISC Core
 46 = Renesas H8/300,300H,H8S
 47 = Hitachi H8/300H
 48 = Hitachi H8S
 49 = Hitachi H8/500
 50 = HP/Intel IA-64
 51 = Stanford MIPS-X
 52 = Motorola ColdFire
 53 = Motorola M68HC12
 54 = Fujitsu MMA Multimedia Accelerator
 55 = Siemens PCP
 56 = Sony nCPU embedded RISC processor
 57 = Denso NDR1 microprocessor
 58 = Motorola Star*Core processor
 59 = Toyota ME16 processor
 60 = STMicroelectronics ST100 processor
 61 = Advanced Logic Corp. TinyJ embedded processor family
 62 = AMD x86-64
 63 = Sony DSP Processor
 64 = Digital Equipment Corp. PDP-10
 65 = Digital Equipment Corp. PDP-11
 66 = Siemens FX66 microcontroller
 67 = STMicroelectronics ST9+ 8/16 bit microcontroller
 68 = STMicroelectronics ST7 8-bit microcontroller
 69 = Motorola MC68HC16 Microcontroller
 70 = Motorola MC68HC11 Microcontroller
 71 = Motorola MC68HC08 Microcontroller
 72 = Motorola MC68HC05 Microcontroller
 73 = Silicon Graphics SVx
 74 = STMicroelectronics ST19 8-bit microcontroller
 75 = Digital VAX
 76 = Axis Communications 32-bit embedded processor
 77 = Infineon Technologies 32-bit embedded processor
 78 = Element 14 64-bit DSP Processor
 79 = LSI Logic 16-bit DSP Processor
 87 = NEC v850
 88 = Renesas M32R
 140 = TMS320C6000 Family
 175 = MCST Elbrus e2k
 183 = Arm 64-bits (Armv8/AArch64)
 220 = Zilog Z80
 243 = RISC-V
 247 = Berkeley Packet Filter
 257 = WDC 65C816
 21569 = Fujitsu FR-V
 36902 = Alpha
 36929 = m32r (old)
 36992 = v850 (old)
 41872 = S/390 (old)
 |  | 
Information extracted from static libraries.
| 
| Index1 | Tag Name | Writable | Values / Notes | 
|---|
 
| 16 | CreateDate | no |  |  | 
Tags extracted from Microsoft Compiled HTML files.
(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Jan 25, 2025
<-- ExifTool Tag Names