Search code examples
windowsportable-executable

what do it mean 0x010f in PE characteristics

Characteristics of My PE File is 010f.

'0100' mean Image_File_32Bit_Machine.

I don't know what It is mean '000f'?

0100 or 000f -> 010f..

Help~

Solution

  • The answer can be found in winnt.h in the SDK include folder. the 0x0F represents these flags being set in characteristics:

    #define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.