MediaInfoLib icon indicating copy to clipboard operation
MediaInfoLib copied to clipboard

MZ/PE: Parse and extract more information

Open cjee21 opened this issue 2 weeks ago • 2 comments

Example (MediaInfo here is built in debug mode so no CFG flag in Dll_Characteristics):

>MediaInfo.exe MediaInfo.exe
General
Complete name                            : MediaInfo.exe
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 15.8 MiB
Encoded date                             : 2025-12-10 15:49:07 UTC
Linker_Version                           : 14.50
Windows_Subsystem                        : Windows CUI
Subsystem_Version                        : 6.0
Dll_Characteristics                      : High Entropy VA, Dynamic Base, NX Compat, Terminal Server Aware
CompanyName                              : MediaArea.net
FileDescription                          : MediaInfo
FileVersion                              : 25.10.0.0
LegalCopyright                           : Copyright (C) 2002-2025 MediaArea.net SARL
ProductName                              : MediaInfo
ProductVersion                           : 25.10.0.0



>MediaInfo.exe MediaInfo.dll
General
Complete name                            : MediaInfo.dll
Format                                   : MZ
Format profile                           : DLL / AMD x86-64
File size                                : 20.0 MiB
Encoded date                             : 2025-12-10 15:49:06 UTC
Linker_Version                           : 14.50
Windows_Subsystem                        : Windows GUI
Subsystem_Version                        : 6.0
Dll_Characteristics                      : High Entropy VA, Dynamic Base, NX Compat
CompanyName                              : MediaArea.net
FileDescription                          : Most relevant technical and tag data for video and audio files
FileVersion                              : 25.10.0.0
LegalCopyright                           : Copyright (C) 2002-2025 MediaArea.net SARL
ProductName                              : MediaInfo
ProductVersion                           : 25.10.0.0



>MediaInfo.exe MediaInfo_GUI_25.09_Windows.exe
General
Complete name                            : MediaInfo_GUI_25.09_Windows.exe
Format                                   : MZ
Format profile                           : Executable / Intel i386
File size                                : 14.5 MiB
Encoded date                             : 2024-03-30 16:55:19 UTC
Linker_Version                           : 6.0
Windows_Subsystem                        : Windows GUI
Subsystem_Version                        : 4.0
Dll_Characteristics                      : Dynamic Base, NX Compat, No SEH, Terminal Server Aware
CompanyName                              : MediaArea.net
FileDescription                          : All about your audio and video files
FileVersion                              : 25.09.0.0
LegalCopyright                           : MediaArea.net
OriginalFilename                         : MediaInfo_GUI_25.09_Windows.exe
ProductName                              : MediaInfo
ProductVersion                           : 25.09.0.0



>MediaInfo.exe C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi
General
Complete name                            : C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi
Format                                   : MZ
Format profile                           : DLL / AMD x86-64
File size                                : 2.72 MiB
Encoded date                             : 2023-06-08 01:25:34 UTC
Linker_Version                           : 14.38
Windows_Subsystem                        : EFI Application
Subsystem_Version                        : 1.0
Dll_Characteristics                      : NX Compat
BootMgr_SVN                              : 7.0
CompanyName                              : Microsoft Corporation
FileDescription                          : Boot Manager
FileVersion                              : 10.0.26100.30227 (WinBuild.160101.0800)
InternalName                             : bootmgr.exe
LegalCopyright                           : © Microsoft Corporation. All rights reserved.
OriginalFilename                         : bootmgr.exe
ProductName                              : Microsoft® Windows® Operating System
ProductVersion                           : 10.0.26100.30227



>MediaInfo.exe C:\Windows\Boot\EFI\memtest.efi
General
Complete name                            : C:\Windows\Boot\EFI\memtest.efi
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 2.49 MiB
Encoded date                             : 2090-12-12 08:44:11 UTC
Linker_Version                           : 14.38
Windows_Subsystem                        : Windows Boot Application
Subsystem_Version                        : 1.0
CompanyName                              : Microsoft Corporation
FileDescription                          : Memory Diagnostic
FileVersion                              : 10.0.26100.7309 (WinBuild.160101.0800)
InternalName                             : memdiag.exe
LegalCopyright                           : © Microsoft Corporation. All rights reserved.
OriginalFilename                         : memdiag.exe
ProductName                              : Microsoft® Windows® Operating System
ProductVersion                           : 10.0.26100.7309



>MediaInfo.exe D:\EFI\boot\grubx64.efi
General
Complete name                            : D:\EFI\boot\grubx64.efi
Format                                   : MZ
Format profile                           : Executable / AMD x86-64
File size                                : 2.26 MiB
Encoded date                             : 2015-01-01 00:00:00 UTC
Windows_Subsystem                        : EFI Application
Dll_Characteristics                      : NX Compat
SBAT                                     : sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md / grub,5,Free Software Foundation,grub,2.14~git20250718.0e36779,https://www.gnu.org/software/grub/ / grub.ubuntu,2,Ubuntu,grub2,2.14~git20250718.0e36779-1ubuntu4,https://www.ubuntu.com/ / grub.ubuntu26,1,Ubuntu,grub2,2.14~git20250718.0e36779-1ubuntu4,https://www.ubuntu.com/ / grub.peimage,2,Canonical,grub2,2.14~git20250718.0e36779-1ubuntu4,https://salsa.debian.org/grub-team/grub/-/blob/master/debian/patches/secure-boot/efi-use-peimage-shim.patch



cjee21 avatar Dec 10 '25 16:12 cjee21

Some parts of the parsing are kind of messy since it is not simple but so far it worked fine with files I tested.


Oh it seems some issues parsing MediaInfo installer version info.


Fixed. Looks like the flag can be both binary or text.

cjee21 avatar Dec 10 '25 16:12 cjee21

Have not found easy way to detect ARM64EC/ARM64X or the CETCOMPAT flag.

cjee21 avatar Dec 10 '25 16:12 cjee21