.EXE File Format – PE signature and COFF file header

The PE signature

Four bytes, 50 45 00 00: the letters PE and two zero bytes. A file whose e_lfanew points anywhere else is not a PE file; it may be one of the older .exe formats, whose headers start NE, LE or LX.

The COFF file header

IMAGE_FILE_HEADER, 20 bytes, straight after the signature:

000000F0  50 45 00 00 64 86 06 00 2D 09 1C 56 00 00 00 00
00000100  00 00 00 00 F0 00 22 20

Machine types

The values Microsoft’s specification lists. In a PE32+ file the machine is nearly always 0x8664 (x64) or 0xAA64 (ARM64), and in the oldest ones 0x0200 (Itanium). An ARM64EC image says 0x8664 in its header, as an x64 image does; an ARM64X image says 0xAA64. The 32-bit machines belong in 32-bit PE files.

The explorer disassembles the code only for 0x8664; see The code. Among the PE32+ files examined for this site, almost all were x64, and about one in a hundred ARM64.

Time stamp

TimeDateStamp is the time the linker made the file, in seconds since 1 January 1970 UTC. In the example, 0x561C092D is 1,444,677,933: 12 October 2015, 19:25:33 UTC. The same value appears in that file’s export directory and debug directory.

A reproducible build, one whose output must be the same every time, puts a hash there instead of a time. Such a file has a REPRO debug entry, and then its time stamps are not times. Some linkers and packers write 0 or a fixed value, so a time stamp is a clue, not a fact.

Characteristics