Module goblin::pe::dll_characteristic

Constants for characteristics of image files. These constants are used in the goblin::pe::optional_header::WindowsFields::dll_characteristics field.

The values 0x0001, 0x0002, 0x0004, 0x0008 are reserved for future use and must be zero.

Constants

• IMAGE_DLLCHARACTERISTICS_APPCONTAINER
  Image must execute in an AppContainer.
• IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
  DLL can be relocated at load time.
• IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
  Code Integrity checks are enforced.
• IMAGE_DLLCHARACTERISTICS_GUARD_CF
  Image supports Control Flow Guard.
• IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
  Image can handle a high entropy 64-bit virtual address space.
• IMAGE_DLLCHARACTERISTICS_NO_BIND
  Do not bind the image.
• IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
  Isolation aware, but do not isolate the image.
• IMAGE_DLLCHARACTERISTICS_NO_SEH
  Does not use structured exception (SE) handling. No SE handler may be called in this image.
• IMAGE_DLLCHARACTERISTICS_NX_COMPAT
  Image is NX compatible.
• IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
  Terminal Server aware.
• IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
  A WDM driver.