Every COFF object file starts at offset 0 with the same 20-byte structure, which a PE
file has after its PE\0\0 signature. The file has no magic number, so the
first field, the machine type, is how a reader recognises one.
IMAGE_FILE_HEADER
0Machine: the processor2 bytes2NumberOfSections2 bytes4TimeDateStamp4 bytes8PointerToSymbolTable4 bytes12NumberOfSymbols4 bytes16SizeOfOptionalHeader: 0 in an object file2 bytes18Characteristics: flags2 bytes
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 2 | Machine | The processor the code is for; see Machine values. |
| 2 | 2 | NumberOfSections | How many entries the section table has. |
| 4 | 4 | TimeDateStamp | The low 32 bits of the number of seconds since 1 January 1970. A reproducible build writes a hash instead. |
| 8 | 4 | PointerToSymbolTable | The file offset of the symbol table, or 0 when there is none. |
| 12 | 4 | NumberOfSymbols | How many 18-byte records the symbol table has, counting the auxiliary records. The string table starts immediately after the last record. |
| 16 | 2 | SizeOfOptionalHeader | 0 in an object file; only images have an optional header. |
| 18 | 2 | Characteristics | Flags; see Characteristics. |
Machine values
| Value | Constant | Processor |
|---|---|---|
0x0 | IMAGE_FILE_MACHINE_UNKNOWN | Any machine; a file that holds no code |
0x14C | IMAGE_FILE_MACHINE_I386 | Intel 386 and later, 32-bit x86 |
0x1C0 | IMAGE_FILE_MACHINE_ARM | ARM, little-endian |
0x1C2 | IMAGE_FILE_MACHINE_THUMB | ARM Thumb |
0x1C4 | IMAGE_FILE_MACHINE_ARMNT | ARM Thumb-2 |
0x200 | IMAGE_FILE_MACHINE_IA64 | Intel Itanium |
0x5064 | IMAGE_FILE_MACHINE_RISCV64 | RISC-V, 64-bit |
0x6264 | IMAGE_FILE_MACHINE_LOONGARCH64 | LoongArch, 64-bit |
0x8664 | IMAGE_FILE_MACHINE_AMD64 | x64 |
0xA641 | IMAGE_FILE_MACHINE_ARM64EC | ARM64 code that interoperates with x64 |
0xAA64 | IMAGE_FILE_MACHINE_ARM64 | 64-bit ARM, little-endian |
The PE Format specification lists the rest (MIPS, Alpha, PowerPC and others).
Characteristics
These flags are mostly for images. In an object file Microsoft’s compiler sets few or none of them, usually leaving the value 0.
| Bit | Constant | Meaning |
|---|---|---|
0x0001 | IMAGE_FILE_RELOCS_STRIPPED | No base relocations |
0x0002 | IMAGE_FILE_EXECUTABLE_IMAGE | A runnable image; not set in an object file |
0x0004 | IMAGE_FILE_LINE_NUMS_STRIPPED | COFF line numbers removed (deprecated) |
0x0008 | IMAGE_FILE_LOCAL_SYMS_STRIPPED | Local symbols removed (deprecated) |
0x0100 | IMAGE_FILE_32BIT_MACHINE | A 32-bit machine |
0x0200 | IMAGE_FILE_DEBUG_STRIPPED | Debug information removed |
0x2000 | IMAGE_FILE_DLL | A DLL; not set in an object file |