In the Windows PE file (Portable Executable) file format, the 16-bit field at offset 0x0004 of the PE header is the “Machine Type” field.
Microsoft currently lists about 30 possible values for this field. The most common ones are probably
IMAGE_FILE_MACHINE_AMD64 0x8664 x64
IMAGE_FILE_MACHINE_I386 0x14c Intel 386 or later processors and compatible processors
But I’ve written a tool to examine binary executable files on my Mac and output some info. I’ve found that I have about 600 of them where this field is set to the value 0xec20
.
All seem to be within the ~/Library/Application Support/
directory. A few different examples:
Code/User/globalStorage/ms-dotnettools.vscode-dotnet-runtime/.dotnet/6.0.7/shared/Microsoft.NETCore.App/6.0.7/Microsoft.CSharp.dll
Code/User/globalStorage/ms-dotnettools.vscode-dotnet-runtime/.dotnet/8.0.3~arm64/shared/Microsoft.NETCore.App/8.0.3/System.Collections.Concurrent.dll
VisualStudio/17.0/LocalInstall/Installer.Backup/11-17.6.11.400/Visual Studio Update.app/Contents/MonoBundle/System.Data.Common.dll
VisualStudio/azure-functions-cli/Releases/4.18.1/cli_arm64/Microsoft.AspNetCore.Antiforgery.dll
VisualStudio/azure-functions-cli/Releases/4.18.1/cli_arm64/Microsoft.Extensions.Caching.Memory.dll
VisualStudio/azure-functions-cli/Releases/4.18.1/cli_arm64/System.Data.Common.dll
I guess what’s common is that they are all relating to VS Code or Visual Studio, they’re all related to Microsoft, they’re all DLLs, and most of them are related to .NET, Mono, or ASP.NET.
Does anybody know what exactly this ‘machine type’ is?
I’ve searched StackOverflow, searched GitHub, searched the internet generally and can’t even find a mention.