PE EXE (Windows 32Bit EXE, DLL, OCX, etc)
| MZ EXE Header | This contains information needed to run the DOS STUB |
| Extended MZ Header | Offset 3ch points to the PE header |
| DOS STUB | Usually displays 'Requires windows to run' or similar message |
| PE Header | Contains info needed to run the Win32 Bit |
| Object table | Information about objects present in file |
| Objects | OBJECT DATA |
MZ EXE Header
| 0000 | Word | ID 'MZ' - Exe file tag |
| 0002 | Word | Number of bytes in last 512byte page of executable |
| 0004 | Word | Total number of 512byte pages in executable (including last page) |
| 0006 | Word | Number of relocation entries |
| 0008 | Word | Header size in paragraphs |
| 000a | Word | Minimum paragraphs of memory allocated in addition to the code size |
| 000c | Word | Maximum paragraphs of memory allocated in addition to the code size |
| 000e | Word | Initial SS relative to start of executable |
| 0010 | Word | Initial SP |
| 0012 | Word | Checksum (or 0) of executable |
| 0014 | Dword | CS:IP relative to start of executable (Entry point) |
| 0018 | Word | Offset of relocation table
40h for new (NE,LE,LX,W3,PE etc) executables |
| 001a | Word | Overlay number (0 = main program) |
Extended MZ Header
| 001c | Dword | ???? |
| 0020 | Word | ? |
| 0022 | 26Bytes | Reserved (0)? |
| 003c | Dword | Offset of New EXE header from start of file
Or 0 if plain MZ EXE file |
PE Header
| 0000 | Dword | Signature - 'PE',0,0 |
| 0004 | Word | CPU_TYPE
0000 - Unknown 0162 - MIPS I 014c - 80386 0163 - MIPS II 014d - 80486 0166 - MIPS III 014e - 80586 |
| 0006 | Word | Number of objects in object table |
| 0008 | Dword | Time/Date stamp |
| 000c | 8Bytes | Reserved |
| 0014 | Word | NT Header size (Following Flags) |
| 0016 | Word | Flags
0 - Program Image 2 - EXE 200 - Fixed address 2000 - Library |
| 0018 | Word | Reserved |
| 001a | Word | Linker version |
| 001c | 12Bytes | Reserved |
| 0028 | Dword | Entry point RVA - Execution starts here. |
| 002c | 8Bytes | Reserved |
| 0034 | Dword | Image Base - start of image in memory |
| 0038 | Dword | Object align (Power of 2 512-256M) |
| 003c | Dword | File align (Power of 2 512-64k) |
| 0040 | Dword | O/S Version required |
| 0044 | Dword | User Version |
| 0048 | Dword | Subsys Version |
| 004c | Dword | Reserved |
| 0050 | Dword | Image size |
| 0054 | Dword | Header size |
| 0058 | Dword | File Checksum (Only used in NT devices) |
| 005c | Word | Subsystem
0 - Unknown 1 - Native 2 - Win GUI 3 - Win Character |
| 005e | Word | DLL Flags |
| 0060 | Dword | Stack reserve size |
| 0064 | Dword | Stack commit size |
| 0068 | Dword | Heap reserve size |
| 006c | Dword | Heap commit size |
| 0070 | Dword | Reserved |
| 0074 | Dword | Number of RVA/Sizes present NOW
All entrys have Dword RVA, Size |
| 0078 | 8Bytes | Export table RVA/Size |
| 0080 | 8Bytes | Import table RVA/Size |
| 0088 | 8Bytes | Resource table RVA/Size |
| 0090 | 8Bytes | Exception table RVA/Size |
| 0098 | 8Bytes | Security table RVA/Size |
| 00a0 | 8Bytes | Fixup table RVA/Size |
| 00a8 | 8Bytes | Debug table RVA/Size |
| 00b0 | 8Bytes | Image description RVA/Size |
| 00b8 | 8Bytes | Machine specific RVA/Size |
| 00c0 | 8Bytes | Local thread storage RVA/Size |
NE Header
| 0000 | Word | ID - 'NE' |
| 0002 | Word | Linker version |
| 0004 | Word | Offset of entry table |
| 0006 | Word | Length of entry table in bytes |
| 0008 | Dword | File load CRC (Or 0) |
| 000c | Byte | Program flags bitmapped:
0-1 - DGroup type 0- none, 1- single shared, 2- multiple, 3- (null) 2 - Global initialization 3 - Protected mode only 4 - 8086 Instructions 5 - 80286 Instructions 6 - 80386 Instructions 7 - 80x87 Instructions |
| 000d | Byte | Application flags bitmapped:
0-2 - Application type 1- Full screen 2- Compat with Windows/PM 3-Uses Win/PM 3 - OS/2 family application 4 - Reserved? 5 - Errors in image/executable 6 - Non-conforming program 7 - DLL or driver (SS:SP info invalid) CS:IP -> Far init routine called with ax=mod handle. returns ax=0 on failure, ax nonzero on successful initialization. |
| 000e | Byte | Auto data segment index |
| 0010 | Word | Initial local heap size |
| 0012 | Word | Initial stack size |
| 0014 | Dword | Entry point CS:IP (CS is index into segment table) |
| 0018 | Dword | Initial stack pointer SS:SP (SS is index into segment table) |
| 001c | Word | Segment count |
| 001e | Word | Module reference count |
| 0020 | Word | Size of nonresident names table in bytes |
| 0022 | Word | Offset of segment table |
| 0024 | Word | Offset of resource table |
| 0026 | Word | Offset of resident names table |
| 0028 | Word | Offset of module reference table |
| 002a | Word | Offset of imported names table |
| 002c | Dword | Offset from start of file to nonresident names table |
| 0030 | Word | Count of moveable entry point listed in entry table |
| 0032 | Word | File alignment size shift count (0 is equivalent to 9) Default 512-byte pages |
| 0034 | Word | Number of resource table entries |
| 0036 | Byte | Target operating system
0- unknown 1- OS/2 2- Windows 3- European DOS 4.x 4- Windows 386 5- BOSS (Borland operating system services) |
| 0037 | Byte | Other OS/2 EXE flags bitmapped:
0- Long filename support 1- 2.x protected mode 2- 2.x proportional fonts 3- EXE has gangload area |
| 0038 | Word | Offset to return thunks or start of gangload area |
| 003a | Word | Offset to segment reference thunks or length of gangload area |
| 003c | Word | Minimum code swap area size |
| 003e | Word | Expected windows version |