.EXE

Introduction

PE, the Portable Executable format, is the format of programs and libraries on 32-bit and 64-bit Windows, introduced with Windows NT 3.1 in 1993. It is built on COFF, the object file format, and holds the program’s code and data in sections, a list of the functions it imports and exports, its resources, and the information Windows needs to load it at any address.

The same format is used under many extensions: programs (.exe), libraries (.dll), drivers (.sys), ActiveX controls (.ocx), screen savers (.scr) and UEFI firmware applications (.efi). .NET programs are PE files too, with their bytecode in a section of the file. See all the .EXE variations.

Structure

A PE file begins with an MS-DOS MZ header and stub program. The 32-bit offset at 0x3C points to the signature PE\0\0, followed by the 20-byte COFF file header: the target machine, the number of sections, a timestamp and flags. The optional header comes next, which despite its name every program has. Its first two bytes say whether the file is PE32 (0x10B, 32-bit) or PE32+ (0x20B, 64-bit). It holds the entry point, the preferred load address, the alignments, the target subsystem, and a table of data directories that locate the imports, exports, resources, relocations, debug data and more.

The section table follows, one 40-byte entry per section, giving each section’s name, its place in memory and its place in the file. Addresses inside the program are relative virtual addresses (RVAs): offsets from the load address, which the section table maps back to file offsets.

Telling .EXE files apart

MS-DOS, Windows and OS/2 programs all start with MZ. The newer formats add a 32-bit offset, e_lfanew, at 0x3C, pointing to a second header. Read the bytes there:

• PE\0\0 means a Windows PE program, this format.
• NE means a 16-bit Windows NE program.
• LE means a Linear Executable.
• LX means an OS/2 LX program.
• Anything else, or an offset past the end of the file, means a plain MS-DOS program.

Within PE, the IMAGE_FILE_DLL flag (0x2000) in the COFF header marks a library, and the optional header’s magic number tells 32-bit from 64-bit.

Links