The property specifies the overlay number, which is normally set e_ovro cyboxCommon: to 0x0000, because few programs actually have overlays. It changes only e_ovro 0..1 in files containing programs that use overlays. See for more information HexBinaryObjectPropertyType about overlays. The property specifies reserved words for the program reserved1 cyboxCommon: (known in winnt.h as e_res[4]), usually set to zero by the linker. In this reserved1 0..4 case, just use a single reserved1 set to zero; if not zero create four HexBinaryObjectPropertyType reserved1 with the correct value. The property specifies the identifier for the OEM for e_oeminfo. cyboxCommon: e_oemid 0..1 e_oemid HexBinaryObjectPropertyType cyboxCommon: The property specifies the OEM information for a specific e_oeminfo e_oeminfo 0..1 value of e_oeminfo. HexBinaryObjectPropertyType The property specifies reserved words for the program reserved2 cyboxCommon: (known in winnt.h as e_res[10]), usually set to zero by the linker. In this reserved2 0..1 case, just use a single reserved1 set to zero; if not zero create ten HexBinaryObjectPropertyType reserved1 with the correct value. The property specifies the file address of the of the new exe e_lfanew cyboxCommon: header. In particular, it is a 4-byte offset into the file the PE file e_lfanew 0..1 header is located. It is necessary to use this offset to locate the PE HexBinaryObjectPropertyType header in the file. The property is used to include any hash values computed using Hashes 0..1 Hashes cyboxCommon:HashListType the specified PE binary MS-DOS header as input.
e_ovro cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_ovro property specifies the overlay number, which is normally set to 0x0000, because few programs actually have overlays. It changes only in files containing programs that use overlays. See for more information about overlays. reserved1 cyboxCommon: HexBinaryObjectPropertyType 0..4 The reserved1 property specifies reserved words for the program (known in winnt.h as e_res[4]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create four reserved1 with the correct value. e_oemid cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_oemid property specifies the identifier for the OEM for e_oeminfo. e_oeminfo cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_oeminfo property specifies the OEM information for a specific value of e_oeminfo. reserved2 cyboxCommon: HexBinaryObjectPropertyType 0..1 The reserved2 property specifies reserved words for the program (known in winnt.h as e_res[10]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create ten reserved1 with the correct value. e_lfanew cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_lfanew property specifies the file address of the of the new exe header. In particular, it is a 4-byte offset into the file the PE file header is located. It is necessary to use this offset to locate the PE header in the file. Hashes cyboxCommon:HashListType 0..1 The Hashes property is used to include any hash values computed using the specified PE binary MS-DOS header as input.
cybox-v2.1.1-csprd01-part69-win-executable-file.docx