2. Definition
The Portable Executable (PE) format is a file
format for executables, object code, and
DLLs, used in 32-bit and 64-bit versions of
Windows operating systems.
The term "portable" refers to the format's
versatility in numerous environments of
operating system software architecture.
3. Basic Structure
•Executable Code Section,
named .text (Microsoft) or CODE
(Borland)
•Data Sections, named .data,
.rdata, or .bss (Microsoft) or
DATA (Borland)
•Resources Section, named .rsrc
•Export Data Section, named
.edata
•Import Data Section, named
.idata
•Debug Information Section,
named .debug
6. DOS ‘MZ’ Header
64 Byte Header
First two bytes of DOS header contain
the value 4Dh, 5Ah (The letters "MZ" for
Mark Zbikowsky one of the original
architects of MS-DOS) which signifies a
valid DOS header.
Last 4 bytes point towards PE Header
7. DOS Stub
If the program is run from DOS, DOS can recognize it as
a valid executable and run the DOS stub which is stored
immediately after the header.
The DOS stub usually just prints a string something like
"This program must be run under Microsoft Windows" but
it can be a full-blown DOS program.
When building an application for Windows, the linker links
a default stub program called WINSTUB.EXE into the
executable. We can override the default linker behavior by
substituting your own valid MS-DOS-based program in
place of WINSTUB and using the -STUB: linker option
when linking the executable file.
8. PE File Header
Also called as Image_NT_Header
Consists of
Signature
Image_File_Header
Image_Optional_Header
9. Signature
4 bytes (Dword) Signature
Value is ‘00004550’ representing
characters ‘PE’
10. Image File Header
20 bytes header
Starting Byte Type Information
1 WORD Machine
3 WORD Number of sections
5 DWORD Time Date stamp
9 DWORD
Pointer to symbol
table
13 DWORD Number of symbols
17 WORD
Size of optional
header
19 WORD Characteristics
11. Optional Header
It contains following important fields:
Address Of Entry Point
Image Base
Section Alignment
File Alignment
Subsystem
Data directory
○ An array of 16 IMAGE_DATA_DIRECTORY structures,
each relating to an important data structure in the PE
file such as the import address table etc.
12. Image_Section_Header
It contains information about various
sections.
It contains following important fields
Name of section
Relative Virtual Address (RVA)
Virtual Size
Characteristics of Section
13. Sections
.text
• Contains the executable code
• Also known as .code
.data
• Contains initialized data
.reloc
• Contains relocation
information