According to PeLib project:
IMAGE_FILE_SYSTEM is set if the file is a system file such as a
driver. This is unused for executable files; it is also not used in
all the NT drivers I inspected.
I combined a quick Powershell script to check whether a file has the IMAGE_FILE_SYSTEM attribute:
function isSystemFile([string] $filename)
{
# Get the content of the file, as an array of bytes
$fileBytes = Get-Content $filename -ReadCount 0 -Encoding byte
$IMAGE_FILE_SYSTEM = 0x1000
# The offset of the signature in the file is stored at location 0x3c.
$offsetOfSignature = $fileBytes[0x3c]
$coffHeader = $offsetOfSignature + 4
# The characteristics data are 18 bytes into the COFF header. The BitConverter ## class manages the conversion of the 4 bytes into an integer.
$characteristicsData = [BitConverter]::ToInt32($fileBytes, $coffHeader + 18)
# Check if the data from the file has IMAGE_FILE_SYSTEM flag set
if(($characteristicsData -band $IMAGE_FILE_SYSTEM) -eq $IMAGE_FILE_SYSTEM)
{
Write-Host "File has IMAGE_FILE_SYSTEM attribute"
}
else
{
Write-Host "Nope :-("
}
}
The script might not be accurate, it was written really quick
More information about System Files can be found here.
Edit: I removed the part about attrib which is a system-level flag. Thanks @Igor for pointing this out.