Class: PEdump::IMAGE_FILE_HEADER

Inherits:
Object
  • Object
show all
Defined in:
lib/pedump.rb

Overview

msdn.microsoft.com/en-us/library/ms809762.aspx

Constant Summary collapse

FLAGS =

Characteristics, msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=VS.85).aspx)

{
  0x0001 => 'RELOCS_STRIPPED',          # Relocation information was stripped from the file.
                                        # The file must be loaded at its preferred base address.
                                        # If the base address is not available, the loader reports an error.
  0x0002 => 'EXECUTABLE_IMAGE',
  0x0004 => 'LINE_NUMS_STRIPPED',
  0x0008 => 'LOCAL_SYMS_STRIPPED',
  0x0010 => 'AGGRESIVE_WS_TRIM',        # Aggressively trim the working set. This value is obsolete as of Windows 2000.
  0x0020 => 'LARGE_ADDRESS_AWARE',      # The application can handle addresses larger than 2 GB.
  0x0040 => '16BIT_MACHINE',
  0x0080 => 'BYTES_REVERSED_LO',        # The bytes of the word are reversed. This flag is obsolete.
  0x0100 => '32BIT_MACHINE',
  0x0200 => 'DEBUG_STRIPPED',
  0x0400 => 'REMOVABLE_RUN_FROM_SWAP',
  0x0800 => 'NET_RUN_FROM_SWAP',
  0x1000 => 'SYSTEM',
  0x2000 => 'DLL',
  0x4000 => 'UP_SYSTEM_ONLY',           # The file should be run only on a uniprocessor computer.
  0x8000 => 'BYTES_REVERSED_HI'         # The bytes of the word are reversed. This flag is obsolete.
}

Instance Method Summary collapse

Instance Method Details

#flags ⇒ Object

def initialize *args

  super
  self.TimeDateStamp = Time.at(self.TimeDateStamp).utc
end



98
99
100
 
# File 'lib/pedump.rb', line 98

def flags
  FLAGS.find_all{ |k,v| (self.Characteristics & k) != 0 }.map(&:last)
end