The Characteristics field contains flags that indicate attributes of the object or image file. The following flags are currently defined:
Flag | Value | Description |
IMAGE_FILE_RELOCS_STRIPPED | 0x0001 | Image only. Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. Operating systems running on top of MS-DOS (Win32s®) are generally not able to use the preferred base address and so cannot run these images. However, beginning with version 4.0, Windows will use an application's preferred base address. The default behavior of the linker is to strip base relocations from EXEs. |
IMAGE_FILE_EXECUTABLE_IMAGE | 0x0002 | Image only. Indicates that the image file is valid and can be run. If this flag is not set, it generally indicates a linker error. |
IMAGE_FILE_LINE_NUMS_STRIPPED | 0x0004 | COFF line numbers have been removed. |
IMAGE_FILE_LOCAL_SYMS_STRIPPED | 0x0008 | COFF symbol table entries for local symbols have been removed. |
IMAGE_FILE_AGGRESSIVE_WS_TRIM | 0x0010 | Aggressively trim working set. |
IMAGE_FILE_LARGE_ADDRESS_AWARE | 0x0020 | App can handle > 2gb addresses. |
IMAGE_FILE_16BIT_MACHINE | 0x0040 | Use of this flag is reserved for future use. |
IMAGE_FILE_BYTES_REVERSED_LO | 0x0080 | Little endian: LSB precedes MSB in memory. |
IMAGE_FILE_32BIT_MACHINE | 0x0100 | Machine based on 32-bit-word architecture. |
IMAGE_FILE_DEBUG_STRIPPED | 0x0200 | Debugging information removed from image file. |
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP | 0x0400 | If image is on removable media, copy and run from swap file. |
IMAGE_FILE_SYSTEM | 0x1000 | The image file is a system file, not a user program. |
IMAGE_FILE_DLL | 0x2000 | The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run. |
IMAGE_FILE_UP_SYSTEM_ONLY | 0x4000 | File should be run only on a UP machine. |
IMAGE_FILE_BYTES_REVERSED_HI | 0x8000 | Big endian: MSB precedes LSB in memory. |