Samples: version EXCEL.EXE (5.604.624 97.10.20 0.00) Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques ------------------------------------------------------- Portable Executable (PE) PE processor: Intel 80386 or upwardly compatible OS version: 4.0 User version: 0.0 Subsystem version: 4.0 Subsystem required: Windows GUI VS_FIXEDFILEINFO: Signature: FEEF04BD Struct ver: 00010000 File version: 8.0:1.4307 Product version: 8.0:1.4307 Flag mask: 0000003F Flags: 00000000 OS: 00000004 NT_BASE File type: 00000001 APP Subtype: 00000000 File Date: 00000000:00000000 version WINWORD.EXE (5.324.560 97.10.20 0.00) Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques -------------------------------------------------------- Portable Executable (PE) PE processor: Intel 80386 or upwardly compatible OS version: 4.0 User version: 8.0 Subsystem version: 4.0 Subsystem required: Windows GUI VS_FIXEDFILEINFO: Signature: FEEF04BD Struct ver: 00010000 File version: 8.0:0.4412 Product version: 8.0:0.4412 Flag mask: 0000003F Flags: 00000000 OS: 00000004 NT_BASE File type: 00000001 APP Subtype: 00000000 File Date: 00000000:00000000 Of course still gives information on Novell NLM and EXE files, Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques -------------------------------------------------------- A NetWare Loadable Module - NLM Version FAXserve - Server (Service Pack 2) NLM start address: 437 (1B5h) NLM autoload: clib, faxdrv, faxconv, faxprint, faxroute NLM Version 5.00i, 1998 July 09 Copyright=(C) Copyright 1992-98 Computer Associates Int'l, Inc. All Rights Reserved. on old and new licence files, Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques -------------------------------------------------------- 4.11 license file, 250 user Serial No: 61716254 OEM ID: 004B FLAG: 0194 Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques -------------------------------------------------------- 4.11 IntranetWare Small Business base license Serial No: 62904868 OEM ID: 0044 FLAG: 0010310C and on Cisco router images. Version v1.51 - Novell/Microsoft file info (C) 1992-2001 MAQUES Software Ltd. - www.huweb.hu/maques -------------------------------------------------------- CW_IMAGE: C1600-Y-MZ CW_FAMILY: C1600 CW_FEATURE: BASIC-IP CW_VERSION: 11.2(16)P, CW_MEDIA: RAM CW_SYSDESCR: Cisco Internetwork Operating System Software IOS (tm) 1600 Software (C1600-Y-MZ), Version 11.2(16)P, RELEASE SOFTWARE (fc1) Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Tue 20-Oct-98 04:23 by dschwart In short, if someone didn't know: All shorts of Novell identification (even the unknowns for Novell), 2.x serial and application number, VAP name, 3.x SERVER.EXE serial and application number, address, hexa dump, 4.x LICENSE serial and application number, user count, upgrade, SFT III, OEM ID, FLAG, Compressed and plain NLM, NLM Copyright, version and revision, date, startaddress, autoload modules (except if compressed), NLM types: NLM,LAN,DSK,NAM,NLM,MSL,NLM,NLM,HAM,CDM,PSM,Protected EXE, DLL, DRV and other Windows files, such as: New Executables (NE), Linear Executables (LE,LX), Windows 386 Executables (W3), Portable Executables (PE) NE/LE Module name, description, OS type, (MS/IBM OS/2, MS Windows v, MS DOS 4.x,MS Windows 386 (WIN95),BOSS) required OS version (NE) and CPU type (LE) PE type files (Windows NT/WIN95) PE Processor: (Intel 80386,Intel 80486,i860,Intel 80586 [Pentium], M68K, MIPS Mark I-R2000/R3000/R3000 little-endian, R3000 big-endian, MIPS Mark II-R6000, MIPS Mark III-R4000 little-endian, Alpha AXP-21064, PARISC, PPC (IBM Power PC-little endian), MPPC (0603,0604,0620-MPPC???) PE OS version, User version, Subsystem version, Subsystem required (Native, Windows GUI, Windows, OS/2, POSIX, character based) PE System File/Dynamic Link Library Compressed files: ----------------- Novell compressed (Packed File), MS compressed (SZDD, KWAJ), SQZ, PKZIP (+selfextract), PKSFX 1.0, PKSFX 1.1, PKJR 2.x, ARJ (+selfextract),LHA (+selfextract) Compressed executable files: ---------------------------- PKLITE (+Extra compression), EXEPACK (type-1, 2), LZEXE (LZ09, LZ91), DIET, SCRNCH Audio and Video files: ---------------------- MOD, WAVE, GIF, JPG, BMP, LBM/IFF, AVI, RIFF Others: -------- Folio, PDF, HTML, WINWORD.DOC 2.0 and some more which I forgot... All of these in less than 8K.