Windows loads only the headers and the sections. Anything in the file after the end
of the last section’s raw data is not part of the image: it is the overlay. A program
can open its own file and read it, and installers and self-extracting archives keep
their whole payload there, so that one .exe carries both the program that
unpacks and what it unpacks. The certificate
table and the COFF symbols also
lie after the sections; the explorer shows them on their own, and calls only the bytes
left over the overlay.
What the explorer recognises
The explorer looks at the start of the overlay, and for some kinds within its first 4 KB:
| Bytes | What it is |
|---|---|
50 4B 03 04 (PK\3\4) | A ZIP archive: a self-extracting ZIP. Also found as a ZIP signature within the first 4 KB. |
4D 53 43 46 00 00 00 00 (MSCF) | A Microsoft Cabinet. |
52 61 72 21 1A 07 (Rar!) | A RAR archive. |
37 7A BC AF 27 1C | A 7z archive. |
;!@Install@! | A 7-Zip self-extractor’s settings, followed by the 7z archive. |
a dword, EF BE AD DE, NullsoftInst | An NSIS installer’s first header: flags, the signature 0xDEADBEEF, NullsoftInst, then the lengths of the header and the data. Also found within the first 4 KB. |
zlb and 0x1A, with rDlPtS at the start of an RCDATA resource | An Inno Setup installer. The resource is the loader’s table of offsets into the overlay. |
Inno Setup Setup Data ( | Inno Setup’s setup data. |
FWS, CWS, ZWS | A Flash movie: the program is a Flash projector. |
7F 45 4C 46 (\x7FELF) | An ELF file. |
MZ | Another program. |
| all zeros, up to 4 KB | Zero padding. |
The fields of NSIS’s first header beyond its signature, and Inno Setup’s layout
beyond the offset table, the zlb block and the setup data string, are
named only as far as the files examined showed them; the explorer does not unpack
either. An overlay it does not recognise is shown as bytes.
00010A00 00 00 00 00 EF BE AD DE 4E 75 6C 6C 73 6F 66 74
00010A10 49 6E 73 74 …0x10A00: flags 0, then 0xDEADBEEF and NullsoftInstAn Inno Setup 5.5 installer, WampServer 2.4’s, starts its overlay with
7A 6C 62 1A (zlb and 0x1A), holds
rDlPtS in an RCDATA resource, and has Inno Setup Setup Data
(5.5.0) further on.
Of the PE files examined for this site that had an overlay, most held only zero padding. The rest were ZIP archives, NSIS and Inno Setup installers, cabinets, a RAR archive, Flash projectors, 7-Zip self-extractors, and debug information and data the explorer does not know.