Skip to content

MZ/PE: Parse and extract more information #2479

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
cjee21 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

MZ/PE: Parse and extract more information #2479

cjee21 wants to merge 4 commits into from

Conversation

@cjee21
Copy link
Contributor

@cjee21 cjee21 commented Dec 10, 2025 •
edited
Loading

Example (MediaInfo here is built in debug mode so no CFG flag in Dll_Characteristics):

>MediaInfo.exe MediaInfo.exe
General
Complete name                            : MediaInfo.exe
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 15.8 MiB
Encoded date                             : 2025-12-10 15:49:07 UTC
Linker_Version                           : 14.50
Windows_Subsystem                        : Windows CUI
Subsystem_Version                        : 6.0
Dll_Characteristics                      : High Entropy VA, Dynamic Base, NX Compat, Terminal Server Aware
CompanyName                              : MediaArea.net
FileDescription                          : MediaInfo
FileVersion                              : 25.10.0.0
LegalCopyright                           : Copyright (C) 2002-2025 MediaArea.net SARL
ProductName                              : MediaInfo
ProductVersion                           : 25.10.0.0



>MediaInfo.exe MediaInfo.dll
General
Complete name                            : MediaInfo.dll
Format                                   : MZ
Format profile                           : DLL / AMD x86-64
File size                                : 20.0 MiB
Encoded date                             : 2025-12-10 15:49:06 UTC
Linker_Version                           : 14.50
Windows_Subsystem                        : Windows GUI
Subsystem_Version                        : 6.0
Dll_Characteristics                      : High Entropy VA, Dynamic Base, NX Compat
CompanyName                              : MediaArea.net
FileDescription                          : Most relevant technical and tag data for video and audio files
FileVersion                              : 25.10.0.0
LegalCopyright                           : Copyright (C) 2002-2025 MediaArea.net SARL
ProductName                              : MediaInfo
ProductVersion                           : 25.10.0.0



>MediaInfo.exe MediaInfo_GUI_25.09_Windows.exe
General
Complete name                            : MediaInfo_GUI_25.09_Windows.exe
Format                                   : MZ
Format profile                           : Executable / Intel i386
File size                                : 14.5 MiB
Encoded date                             : 2024-03-30 16:55:19 UTC
Linker_Version                           : 6.0
Windows_Subsystem                        : Windows GUI
Subsystem_Version                        : 4.0
Dll_Characteristics                      : Dynamic Base, NX Compat, No SEH, Terminal Server Aware
CompanyName                              : MediaArea.net
FileDescription                          : All about your audio and video files
FileVersion                              : 25.09.0.0
LegalCopyright                           : MediaArea.net
OriginalFilename                         : MediaInfo_GUI_25.09_Windows.exe
ProductName                              : MediaInfo
ProductVersion                           : 25.09.0.0



>MediaInfo.exe C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi
General
Complete name                            : C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi
Format                                   : MZ
Format profile                           : DLL / AMD x86-64
File size                                : 2.72 MiB
Encoded date                             : 2023-06-08 01:25:34 UTC
Linker_Version                           : 14.38
Windows_Subsystem                        : EFI Application
Subsystem_Version                        : 1.0
Dll_Characteristics                      : NX Compat
BootMgr_SVN                              : 7.0
CompanyName                              : Microsoft Corporation
FileDescription                          : Boot Manager
FileVersion                              : 10.0.26100.30227 (WinBuild.160101.0800)
InternalName                             : bootmgr.exe
LegalCopyright                           : © Microsoft Corporation. All rights reserved.
OriginalFilename                         : bootmgr.exe
ProductName                              : Microsoft® Windows® Operating System
ProductVersion                           : 10.0.26100.30227



>MediaInfo.exe C:\Windows\Boot\EFI\memtest.efi
General
Complete name                            : C:\Windows\Boot\EFI\memtest.efi
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 2.49 MiB
Encoded date                             : 2090-12-12 08:44:11 UTC
Linker_Version                           : 14.38
Windows_Subsystem                        : Windows Boot Application
Subsystem_Version                        : 1.0
CompanyName                              : Microsoft Corporation
FileDescription                          : Memory Diagnostic
FileVersion                              : 10.0.26100.7309 (WinBuild.160101.0800)
InternalName                             : memdiag.exe
LegalCopyright                           : © Microsoft Corporation. All rights reserved.
OriginalFilename                         : memdiag.exe
ProductName                              : Microsoft® Windows® Operating System
ProductVersion                           : 10.0.26100.7309



>MediaInfo.exe D:\EFI\boot\grubx64.efi
General
Complete name                            : D:\EFI\boot\grubx64.efi
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 2.26 MiB
Encoded date                             : 2015-01-01 00:00:00 UTC
Windows_Subsystem                        : EFI Application
Dll_Characteristics                      : NX Compat
SBAT                                     : sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md / grub,5,Free Software Foundation,grub,2.14~git20250718.0e36779,https://www.gnu.org/software/grub/ / grub.ubuntu,2,Ubuntu,grub2,2.14~git20250718.0e36779-1ubuntu4,https://www.ubuntu.com/ / grub.ubuntu26,1,Ubuntu,grub2,2.14~git20250718.0e36779-1ubuntu4,https://www.ubuntu.com/ / grub.peimage,2,Canonical,grub2,2.14~git20250718.0e36779-1ubuntu4,https://salsa.debian.org/grub-team/grub/-/blob/master/debian/patches/secure-boot/efi-use-peimage-shim.patch

@cjee21
Copy link
Contributor Author

cjee21 commented Dec 10, 2025 •
edited
Loading

Some parts of the parsing are kind of messy since it is not simple but so far it worked fine with files I tested.

Oh it seems some issues parsing MediaInfo installer version info.

Fixed. Looks like the flag can be both binary or text.

@cjee21
Copy link
Contributor Author

cjee21 commented Dec 10, 2025

Have not found easy way to detect ARM64EC/ARM64X or the CETCOMPAT flag.

@cjee21 cjee21 force-pushed the PE branch 2 times, most recently from 34717cc to 5a419cd Compare December 11, 2025 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cjee21