Windows PE Format

Portable Executable (PE) is the executable-image format used by Windows and by UEFI PE/COFF images. Unlike ELF, PE has no program-header table. The loader maps the image from the COFF header, optional header, section table, and data directories.

File Layout #

A PE image starts with a DOS header (MZ). Its e_lfanew member points to the NT headers, which begin with the PE\0\0 signature. A DOS stub follows the DOS header; some toolchains also emit a non-standard Rich header before the NT headers.

The NT headers contain a COFF file header and, for executable images and DLLs, an optional header. The COFF header records the target machine, section count, timestamp, symbol-table location (normally unused in final images), optional-header size, and characteristics such as executable-image or DLL. Relocatable COFF object files have no optional header.

Optional Header and Addressing #

The PE32 optional header is 224 bytes and the PE32+ header is 240 bytes. PE32+ uses 64-bit address fields and omits BaseOfData. Magic identifies PE32 (0x10b), PE32+ (0x20b), or a ROM image (0x107).

An RVA, or relative virtual address, is an offset from the image base. At run time, the virtual address is ImageBase + RVA; the preferred ImageBase is only a request, and base-relocation records let the loader map an ASLR-enabled image elsewhere. AddressOfEntryPoint and BaseOfCode are RVAs. BaseOfCode identifies the first code byte in the image; it is not a guarantee that all executable code is contiguous.

FileAlignment controls section alignment on disk, while SectionAlignment controls alignment in memory and is normally at least as large. SizeOfHeaders covers all headers and padding before section data, and SizeOfImage is the aligned in-memory extent. The Subsystem selects the required environment, for example Windows GUI, console, or an EFI boot-service driver. Data directories point to tables for imports, exports, resources, exceptions, certificates, base relocations, debug information, TLS, and other loader features.

Sections #

Each section header maps a range of file data to a range of virtual memory and marks it with characteristics such as readable, writable, executable, initialized data, or uninitialized data. Familiar names include .text, .rdata, .data, .pdata, and .reloc, but names are conventions rather than loader requirements. VirtualSize may exceed SizeOfRawData; the loader zero-fills the remainder, which is how uninitialized data is represented.