Saturday, December 6, 2025

Window Portable Executable

The compiler generate an object file in COFF format.   The linker modify the COFF to produce the PE file structure 

The PE file starts with a DOS header with the magic number MZ. The .e_Ifanew field contain the RVA, relative virtual address, of the NT header in the PE file. 

NT header contain the File Header which the .NumberOfSection field co rain the number of sections produced ed by the compiler.  Following the File Header structure fire is the Optional Header structure produced by the linker in the last stage of compilation. 

After the NT header is an array of section headers each describe the sections (e.g. text, data etc) produced by the compiler  th actual sections is placed after this array  


No comments: