Does IMAGE_FILE_SYSTEM actually means System file

Question

I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure.

According to all specs it says that file having this set is System file. However it doesn't clarify meaning of System file, also I have checked bunch of files from System32 and none of those had it set.

Does anyone knows actual meaning of this flag (and if it is not deprecated) and has any real life sample with this flag set.

Answer 1

According to PeLib project:

IMAGE_FILE_SYSTEM is set if the file is a system file such as a driver. This is unused for executable files; it is also not used in all the NT drivers I inspected.

I combined a quick Powershell script to check whether a file has the IMAGE_FILE_SYSTEM attribute:

function isSystemFile([string] $filename)
{
    # Get the content of the file, as an array of bytes 
    $fileBytes = Get-Content $filename -ReadCount 0 -Encoding byte

    $IMAGE_FILE_SYSTEM = 0x1000 

    # The offset of the signature in the file is stored at location 0x3c. 
    $offsetOfSignature = $fileBytes[0x3c]

    $coffHeader = $offsetOfSignature + 4

    # The characteristics data are 18 bytes into the COFF header. The BitConverter ## class manages the conversion of the 4 bytes into an integer. 
    $characteristicsData = [BitConverter]::ToInt32($fileBytes, $coffHeader + 18)

    # Check if the data from the file has IMAGE_FILE_SYSTEM flag set

    if(($characteristicsData -band $IMAGE_FILE_SYSTEM) -eq $IMAGE_FILE_SYSTEM) 
    {
        Write-Host "File has IMAGE_FILE_SYSTEM attribute" 
    } 
    else
    {
        Write-Host "Nope :-("
    }
}

The script might not be accurate, it was written really quick

More information about System Files can be found here.

---

Edit: I removed the part about attrib which is a system-level flag. Thanks @Igor for pointing this out.

Answer 2

I guess it was intended for system files in early NT versions but is unused nowadays. Apparently you can set this flag by using the /dll:system switch of LINK.EXE but I don't know of any file actually using it; however apparently such files won't be loaded in user mode (see comment).