PE file format Written By codez =========================================== ========= No size offset note ------------------------------------- ---------------- # Pe Signature01 DWord 0000 PE File Sign (50 45 00 00) # image_file_header structure02 Word 0004 Machine computer processor type 03 Word 0008 Numberofsections segment number 04 DWORD 0008 TIMEDATESTAMP Time 05 DWORD 000C Pointertosymboltable Symbol Table Pointer 06 DWORD 0010 NumberOfsymbols Symbol Table Number 07 WORD 0014 SizeOfOptionHeader Option Head Size 08 Word 0016 Characteristics Image Features [size =
0x18] # IMAGE_OPTIONAL_HEADER Structure09 WORD 0018 Magic magic number 10 BYTE 001A 12 DWORD 001C SizeOfCode code segment size MajorLinkerVersion the connector main version number 11 BYTE 001B MinorLinkerVersion connector minor version number 13 DWORD 0020 SizeOfInitializedData initialization data segment size 14 DWORD 0024 SizeOfUninitializedData uninitialized data segment size 15 DWORD 0028 AddressOfEntryPoint program entry address 16 DWORD 002C BaseOfCode code base 17 DWORD 0030 BaseOfData data segment base 18 DWORD 0034 ImageBase image address 19 DWORD 0038 SectionAlignment image alignment 20 DWORD 003C FileAlignment document alignment 21 WORD 0040 MajorOperatingSystemVersion OS major version 22 WORD 0042 MinorOperatingSystemVersion OS version 23 WORD 0044 MajorImageVersion secondary image of the master version of the image 24 WORD 0046 MinorImageVersion minor version 25 WORD 0048 MajorSubsystemVersion subsystem 26 WORD 004A MinorSubsystemVersion major version version subsystem 27 DWORD 004E Win32VersionValue times using 28 DWORD 0052 SizeOfImage reserved image size 29 DWORD 0056 SizeOfheaders include MS-DOS STUB and PE header and the size of the segment table 30 DWORD 005A CheckSum check value 31 WORD 005C Subsystem Sub Type 32 WORD 005E DllCharacteristics (0x2000 -> WDM driver) 33 DWORD 0060 SizeOfStackReserve reserved stack size 34 DWORD 0064 SizeOfStackCommit submitted stack size 35 DWORD 0068 SizeOfHeapReserv Reserved Heap Size 36 DWORD 006C SizeOfheapCommit Subsida Size 37 DWORD 0070 Loaderflags Load Sign 38 DWORD 0074 Numberofrvaandsizes [Size = 0x78] ========================== ============================
