Module goblin::pe::characteristic

Constants for flags that indicate attributes of the object or image file. These flags are used in the goblin::pe::header::CoffHeader::characteristics field.

Constants

• IMAGE_FILE_32BIT_MACHINE
  Machine is based on a 32-bit-word architecture.
• IMAGE_FILE_AGGRESSIVE_WS_TRIM
  Obsolete. Aggressively trim working set. This flag is deprecated for Windows 2000 and later and must be zero.
• IMAGE_FILE_BYTES_REVERSED_HI
  Big endian: the MSB precedes the LSB in memory. This flag is deprecated and should be zero.
• IMAGE_FILE_BYTES_REVERSED_LO
  Little endian: the least significant bit (LSB) precedes the most significant bit (MSB) in memory. This flag is deprecated and should be zero.
• IMAGE_FILE_DEBUG_STRIPPED
  Debugging information is removed from the image file.
• IMAGE_FILE_DLL
  The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run.
• IMAGE_FILE_EXECUTABLE_IMAGE
  Image only. This indicates that the image file is valid and can be run. If this flag is not set, it indicates a linker error.
• IMAGE_FILE_LARGE_ADDRESS_AWARE
  Application can handle > 2-GB addresses.
• IMAGE_FILE_LINE_NUMS_STRIPPED
  COFF line numbers have been removed. This flag is deprecated and should be zero.
• IMAGE_FILE_LOCAL_SYMS_STRIPPED
  COFF symbol table entries for local symbols have been removed. This flag is deprecated and should be zero.
• IMAGE_FILE_NET_RUN_FROM_SWAP
  If the image is on network media, fully load it and copy it to the swap file.
• IMAGE_FILE_RELOCS_STRIPPED
  Image only, Windows CE, and Microsoft Windows NT and later. This indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. The default behavior of the linker is to strip base relocations from executable (EXE) files.
• IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
  If the image is on removable media, fully load it and copy it to the swap file.
• IMAGE_FILE_SYSTEM
  The image file is a system file, not a user program.
• IMAGE_FILE_UP_SYSTEM_ONLY
  The file should be run only on a uniprocessor machine.
• RESERVED
  This flag is reserved for future use.

Functions

• is_dll
  Checks whether the characteristics value indicates that the file is a DLL (dynamically-linked library).
• is_exe
  Checks whether the characteristics value indicates that the file is an executable.