Reading PE COFF Header and getting characteristics flag

Question

I am trying to read COFF header from PE .exe files on Windows, and it works just fine until I get to the characteristics flag of the header: it seems I am reading a bad value since it doesn't show up in the list of contemplated values listed here. Code:

#include <stdio.h>
#include <stdint.h>
#include <windows.h>
#include <stdlib.h>


typedef struct
{
    uint16_t mType;
    uint16_t nSections;
    uint32_t timeDateStamp;
    uint32_t ptrToSymbolTable;
    uint32_t nOfSymbols;
    uint16_t sizeOfOptionalH;
    uint16_t characteristics;
}COFFHeader;

void printHInfos(COFFHeader *header)
{
    printf("\n\nCPU Type: ");
    switch(header -> mType)
    {
        case IMAGE_FILE_MACHINE_UNKNOWN:
            printf("Cannot determine CPU Target of PE\n");
            break;
        case IMAGE_FILE_MACHINE_AM33:
            printf("Matsushita AM33\n");
            break;
        case IMAGE_FILE_MACHINE_AMD64:
            printf("x64\n");
            break;
        case IMAGE_FILE_MACHINE_ARM:
            printf("ARM Little Endian\n");
            break;
        case IMAGE_FILE_MACHINE_ARM64:
            printf("ARM64 Little Endian\n");
            break;
        case IMAGE_FILE_MACHINE_ARMNT:
            printf("ARM Thumb-2 little endian\n");
            break;
        case IMAGE_FILE_MACHINE_EBC:
            printf("EFI byte code\n");
            break;
        case IMAGE_FILE_MACHINE_I386:
            printf("Intel 386 or later processor\n");
            break;
        case IMAGE_FILE_MACHINE_IA64:
            printf("Intel Itanium processor family\n");
            break;
        case IMAGE_FILE_MACHINE_M32R:
            printf("Mitsubishi M32R Little Endian\n");
            break;
        case IMAGE_FILE_MACHINE_MIPS16:
            printf("MIPS16\n");
            break;
        case IMAGE_FILE_MACHINE_MIPSFPU:
            printf("MIPS with FPU\n");
            break;
        case IMAGE_FILE_MACHINE_MIPSFPU16:
            printf("MIPS16 with FPU\n");
            break;
        case IMAGE_FILE_MACHINE_POWERPC:
            printf("Power PC little endian\n");
            break;
        case IMAGE_FILE_MACHINE_POWERPCFP:
            printf("Power PC with floating point support\n");
            break;
        case IMAGE_FILE_MACHINE_R4000:
            printf("MIPS Little Endian\n");
            break;
        case IMAGE_FILE_MACHINE_SH3:
            printf("Hitachi SH3\n");
            break;
        case IMAGE_FILE_MACHINE_SH3DSP:
            printf("Hitachi SH3 DSP\n");
            break;
        case IMAGE_FILE_MACHINE_SH4:
            printf("Hitachi SH4\n");
            break;
        case IMAGE_FILE_MACHINE_SH5:
            printf("Hitachi SH5\n");
            break;
        case IMAGE_FILE_MACHINE_THUMB:
            printf("Thumb\n");
            break;
        case IMAGE_FILE_MACHINE_WCEMIPSV2:
            printf("MIPS Little-Endian WCE v2\n");
            break;
    }
    printf("Number of sections: %u\n",header->nSections);
    printf("Elapsed seconds since 01/01/70 up to file creation: %u\n",header->timeDateStamp);
    printf("COFF Symbol Table offset: 0x%02X\n",header->ptrToSymbolTable);
    printf("Number of symbols in table: %u\n",header->nOfSymbols);
    printf("Size of optional header: %u\n",header->sizeOfOptionalH);
    printf("Characteristics flag: 0x%02X",header->characteristics);
    return;
}



int main(int argc, char *argv[])
{
    uint32_t *headerLoc = malloc(sizeof(uint32_t));
    COFFHeader header;
    // Finding header offset

    FILE *fp = fopen(argv[1],"rb");
    fseek(fp, 0x3c, SEEK_SET);
    fread(headerLoc,sizeof(uint32_t),1,fp);
    fseek(fp, (*headerLoc) + 4, SEEK_SET);
    free(headerLoc);
    fread(&header, sizeof(COFFHeader), 1, fp);
    printHInfos(&header);
    fclose(fp);

}

As I said, all fields of the header are printed correctly, CPU Target is matching what I expect it to be and yada yada yada, except for the characteristics field, which sometimes comes up as '0x30F', sometimes as '0x10F' etc. What could be wrong with the program? I thought it could be an endianness problem, but it isn't. Thanks in advance for the help.

OS: Win 7 x64, IDE: Code::Blocks, Compiler: mingw32-x86_64

Answer 1

The values you describe are bitflags, you have to determine them individually.

i.e:

0x10F = IMAGE_FILE_RELOCS_STRIPPED|IMAGE_FILE_EXECUTABLE_IMAGE|IMAGE_FILE_LOCAL_SYMS_STRIPPED|IMAGE_FILE_32BIT_MACHINE 

0x30f = IMAGE_FILE_RELOCS_STRIPPED|IMAGE_FILE_EXECUTABLE_IMAGE|IMAGE_FILE_LOCAL_SYMS_STRIPPED|IMAGE_FILE_32BIT_MACHINE|IMAGE_FILE_DLL

So to print the correct values you have to use something like:

if (header->characteristics & IMAGE_FILE_RELOCS_STRIPPED)
    printf("IMAGE_FILE_RELOCS_STRIPPED");

if (header->characteristics & IMAGE_FILE_EXECUTABLE_IMAGE)
    printf("IMAGE_FILE_EXECUTABLE_IMAGE");

...