Lines Matching full:windows
45 # MEXW32:MATLAB Windows 32bit compiled function https://en.wikipedia.org/wiki/MATLAB
46 # MEXW64:MATLAB Windows 64bit compiled function https://en.wikipedia.org/wiki/MATLAB
104 >>>(0x3c.l+0x36) byte 2 for MS Windows
126 # Reference: https://docs.microsoft.com/de-de/windows/win32/debug/pe-format
129 # https://docs.microsoft.com/de-de/windows/win32/debug/pe-format#characteristics
136 # https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#windows-subsystem
182 # 1~IMAGE_SUBSYSTEM_NATIVE device drivers and native Windows processes
187 >>>0 default x for MS Windows
193 # - NT kernel drivers: Windows/System32/drivers/*.sys
203 # 2~IMAGE_SUBSYSTEM_WINDOWS_GUI The Windows graphical user interface (GUI) subsystem
208 >>>0 default x for MS Windows
226 # 3~IMAGE_SUBSYSTEM_WINDOWS_CUI The Windows character subsystem
231 >>>0 default x for MS Windows
239 # 4~Old Windows CE subsystem (never used)
240 #>>(0x3c.l+92) leshort 4 for MS Windows CE OLD
243 … in image files, constant used only in in-memory structures of OS/2 subsystem as part of Windows NT
246 # NO Windows Subsystem number 6!
268 # 9~IMAGE_SUBSYSTEM_WINDOWS_CE_GUI Windows CE
273 >>>0 default x for MS Windows CE
307 # NO Windows Subsystem number 15!
310 # 16~IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION Windows boot application
311 >>(0x3c.l+92) leshort 16 for MS Windows
344 # "(8.s*16) string !32STUB for MS Windows"
346 # sounds like Borland DOS extender with PE loader and Windows emulation which
347 # can be injected into any valid Windows PE binary.
437 # Application type (bits 0-2); 1~Full screen (not aware of Windows/P.M. API)
438 # 2~Compatible with Windows/P.M. API 3~Uses Windows/P.M. API
439 #>>>(0x3c.l+0x0D) ubyte&0x07 =1 \b, Not compatiblr with Windows/P.M. API (full screen)
440 #>>>(0x3c.l+0x0D) ubyte&0x07 =2 \b, Compatible with Windows/P.M. API (console mode)
441 #>>>(0x3c.l+0x0D) ubyte&0x07 =3 \b, use Windows/P.M. API (window mode)
492 # targOS; Target OS; 0~unspecified (OS/2 or Windows); detect it based on Windows-only flags and OS/…
495 # if windows version is specified then it is windows binary
496 >>>>>(0x3c.l+0x3E) ushort !0 for MS Windows
506 >>>>>>(0x3c.l+0x2a) leshort 0 for OS/2 1.x or MS Windows 1.x/2.x
511 # Binaries with KERNEL, USER or GDI import library are for Windows
513 >>>>>>>>&(&0.s-0x29) regex/512/C KERNEL|USER|GDI for MS Windows 1.x/2.x
517 >>>>>>>>(0x3c.l+0x2a) default x for OS/2 1.x or MS Windows 1.x/2.x
519 >>>>(0x3c.l+0x36) byte 2 for MS Windows
520 # expctwinver; expected Windows version (minor first) like:
521 # 0.0~DTM.DLL 203.4~Windows 1.03 GDI.EXE 2.1~TTY.DRV 3.0~dos737.fon FMFONT.FOT THREED.VBX 3.10~GDI.…
525 # Empty version is is treated by Windows 3.x OS as Windows 2.01 version and by Windows 2.x OS as Wi…
533 # Windows P-code application
539 # Filter out false-positive Windows 3.x applications with OS/2 WLO loader
544 # 32-bit Watcom Win386 extender in 16-bit Windows 3.x NE binaries
554 # OS 4 was reserved for MS Windows/386 device drivers but MS Windows/386 2.x never used NE format (…
555 #>>>>(0x3c.l+0x36) byte 4 for MS Windows/386 device driver
590 # can be created by BIND286.EXE from Windows NE binary
591 >>>>(0x3c.l+0x36) byte 0x82 for MS-DOS, Phar Lap 286 DOS extender, emulating MS Windows
612 # These versions are used only by WINE, Windows 1.x/2.x and Multitasking MS-DOS
624 >>>>>(0x3c.l+0x2a) default x for MS Windows 1.x/2.x
625 # Special case, Windows 3.x OS parse from NE version 4 binaries also following NE version 5 fields:
628 # Such NE version 4 binary is treated by Windows 3.x OS as Windows 2.01
629 # compatible binary and by Windows 2.x OS as Windows 1.01 compatible binary.
691 # MS Windows system file, supposedly a collection of LE executables
693 >>(0x3c.l) string W3 \b, W3 for MS Windows
697 # Windows 3.x WIN386.EXE
700 # Windows 95 VMM32.VXD
705 >>(0x3c.l) string W4 \b, W4 for MS Windows
708 # windows 98 VMM32.VXD
745 # OS 2 was reserved for MS Windows 16-bit but it never used LE (NE format was used instead)
746 #>>>(0x3c.l+0x0a) leshort 2 for MS Windows 16-bit
749 >>>(0x3c.l+0x0a) leshort 4 for MS Windows
753 …odule (0x08000) with no external fixups (0x20) for i386 CPU (2) is .386 VxD file for MS Windows 3.x
758 # VXD: VxD for MS Windows 95/98/Me
948 >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
971 # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extr…
1046 # Windows and later versions of DOS will allow .EXEs to be named with a .COM
1108 …; target operating system like: 0~unknown 1~OS/2 2~Windows 16-bit 3~Multitasking MS-DOS 4.x 4~Wind…
1136 # OS 2 was reserved for MS Windows 16-bit but it never used LX (NE format was used instead)
1137 #>0x0a leshort 2 for MS Windows 16-bit
1140 # OS 4 was reserved for MS Windows device drivers but it never used LX (LE format was used instead)
1141 #>0x0a leshort 4 for MS Windows
1368 # like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2)
1421 # https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip
1696 >>96 uleshort !0 Write 3.0 (Windows) Document
1866 # GRR: line above is too general as it catches also MS Windows CURsor
1867 # to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
1869 # skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
1871 # skip Windows cursors with image width 256 and keep Lotus with positive opcode
1958 #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media pl…
1961 # Windows Metafile .WMF
1964 # Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WM…
1966 # Note: called "Windows Metafile" by TrID and
1967 # verified by ImageMagick `identify -verbose *.wmf` as WMF (Windows Meta File)
1970 # Note: called "Windows Metafile Image with Placeable File Header" by DROID via PUID x-fmt/119
1971 …ed by XnView `nconvert -info abydos.wmf SPA_FLAG.wmf hardcopy-windows-meta.wmf` as "Windows Placea…
1974 >26 uleshort&0xFDff =0x0100 Windows metafile
1979 # sometimes useful like: hardcopy-windows-meta.wmf (0,0 / 1280,1024)
1999 0 string/b \002\000\011\000 Windows metafile
2002 # Note: called "Windows Metafile (old Win 3.x format)" by TrID and
2003 # "Windows Metafile Image without Placeable File Header" by DROID via PUID x-fmt/119
2004 # verified by XnView `nconvert -info *.wmf` as Windows metafile
2008 >18 ulelong >0 Windows metafile
2013 # display information of Windows metafile header (type, size, objects)
2032 # NumberOfObjects: the number of graphics objects like: 0 hardcopy-windows-meta.wmf 1 2 3 4 5 6 7 8…
2053 # windows zips files .dmf
2054 0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special …
2056 # Windows icons
2059 # Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
2069 # skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
2073 >>(18.l) ulelong x MS Windows
2129 # Windows non-animated cursors
2132 # Note: similar to Windows ICOn. container for BMP ( only DIB part)
2152 # Windows Recycle Bin record file (named INFO2)
2159 >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
2162 >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
2186 0 string PMCC Windows 3.x .GRP file
2192 # only for windows versions equal or greater 3.0
2193 0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
2203 >0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
2216 #>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
2217 #>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
2218 >0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
2219 #>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
2245 # Only tested with version 5.50 (english) and 2.01 (Windows)
2393 0 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data
2429 # Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
2431 >0x2c search/968/c gadget.xml \b, Windows Desktop Gadget
2434 !:mime application/x-windows-gadget
2456 # no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail
2461 # URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/building-device-metadata-…
2476 # extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
2483 # that is called "Windows Update meta data" by Microsoft
2499 # or POWERPNT.PPT packed as POWERPNT.PP_ found on Windows 2000,XP setup CD in directory i386
2503 # https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
2504 # first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
2505 # or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
2506 >>>>>&0 string/c theme \b, Windows
2507 !:mime application/x-windows-themepack
2508 # https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
2509 # 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
2526 # 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
2540 # neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
2541 >>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup
2690 # Windows CE package files
2707 # Windows Enhanced Metafile (EMF)
2711 >40 string \ EMF Windows Enhanced Metafile (EMF) image data
2741 # Windows CE Binary Image Data Format
2743 0 string/b B000FF\n Windows Embedded CE binary image
2826 # Reference: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofil…
2904 # Workspace .xlw Arrangement of the windows of multiple Workbooks
2907 # Windows API