Strange flag in WIN32 PECOFF

Aaron W. LaFramboise aaron98wiridge9@aaronwl.com
Tue Mar 15 00:22:00 GMT 2005


Hanzac Chen wrote:

> I found the latest version of binutils (GNU binutils 2.15.94
> 20050118) will produce a PECOFF object with IMAGE_FILE_32BIT_MACHINE
> (aka: F_AR32WR) on, in the field Characteristics (aka: f_flags) of
> the COFF File Header.
> 
> But in previous versions (like 2.14 if I remembered clear), this
> flag will be turn off.

Correct.  This is due to Jeff Muizelaar's patch
<http://sources.redhat.com/ml/binutils/2003-07/msg00215.html>.

All i386-pe executables should have this flag set to indicate the binary
is for a 32-bit machine.  The PECOFF specification seems to indicate
that this is the right thing.  In addition, Microsoft's linker,
Borland's linker, and lcclnk (among others, I'm sure) all set this flag.

> I think it's strange and inconsistent, I hope you can give me
> some explanation. BTW: I'm writing a COFF object parser, and
> want to support two kinds of COFF, one is from MingW and the
> other from DJGPP. So I need to rely on the difference of the
> file's format. I know that the two kinds of formats' absolute
> relocation method are different. Does the F_AR32WR flag I mentioned
> above has some relation with this relocation difference?

I don't think this flag will change the behavior of the relocations
because the each relocation type is specified to operate on a specific
word size.

To be honest, I don't know anything about DJGPP's COFF, but its my
understanding that its significantly different from PECOFF.  I don't
think DJGPP implements any of the PE-specific parts of COFF.

If you're trying to distinguish PECOFF objects from other sorts of COFF
objects, I think you'll want to look for the magic number in the
optional header (which isn't optional in PE).


Aaron W. LaFramboise



More information about the Binutils mailing list