.EXE File Format – PE signature and COFF file header

The PE signature

Four bytes, 50 45 00 00: the letters PE and two zero bytes. A file whose e_lfanew points anywhere else is not a PE file; it may be one of the older .exe formats, whose headers start NE, LE or LX.

The COFF file header

IMAGE_FILE_HEADER, 20 bytes, straight after the signature:

00000100  50 45 00 00 4C 01 05 00 21 09 1C 56 00 00 00 00
00000110  00 00 00 00 E0 00 02 21

Machine types

The values Microsoft’s specification lists. In a PE32 file the machine is nearly always 0x014C; the others are those of Windows NT on other processors, Windows CE, 32-bit ARM Windows and EFI. The 64-bit values belong in a PE32+ file.

The explorer disassembles the code only for 0x014C; see The code. Among the PE32 files examined for this site, almost all were i386; a few were ARMNT, Alpha AXP or MIPS R4000.

Time stamp

TimeDateStamp is the time the linker made the file, in seconds since 1 January 1970 UTC. In the example, 0x561C0921 is 1,444,677,921: 12 October 2015, 19:25:21 UTC. The same value appears in that file’s export directory and debug directory.

A reproducible build, one whose output must be the same every time, puts a hash there instead of a time. Such a file has a REPRO debug entry, and then its time stamps are not times. Some linkers and packers write 0 or a fixed value, so a time stamp is a clue, not a fact.

Characteristics