Saturday, December 6, 2025

NT Header - Optional Header

This structure is added by the linker. 

ImageBase contain the memory address to load the text action in memory determined at compile time (0x400000 or 0x800000 by default).

SizeOfMemory is the size of memory to allocate to holds anll the sections above the ImageBase address when the program is load. 

SizeOfHeadet contains the size of DOS, NT and Sectii in on headers combined. 

AddresssOfEntryPoint points to the beginning of the text action. 

File alignment indicate the byte alignment of each section in the PE file. For example, if the value is 0x200, a section of 10 byte will padded to a section size of 0x200 bytes. A section of 202 bytes will padded to a size of 0x400 bytes 

SextionAlignment field bdicate the section alignment when loaded into memory and default to 0x1000 in 32 bits. 

DataDictionary field is a table containing the starting point and size of 15 program details - export directory, import directory, resource directory, exception directory, security directory authentication code,base relocation table, debug directory, x86 specific data, global pointer offset table, thread local storage (TLS), load configuration directory, bound import directory in headers, inport address table, delay load import descriptor, COM runtime descriptor. 

No comments: