Pe explorer cnet windows#

The following values defined for the Subsystem field of the optional header determine which Windows subsystem if any is required to run the image.

They contain additional information that is required by the linker and loader in Windows. The next 21 fields are an extension to the COFF optional header format. These fields contain general information that is useful for loading and running an executable file. The first eight fields of the optional header are standard fields that are defined for every implementation of COFF. In addition, it is important to validate the optional header magic number for format compatibility. The NumberOfRvaAndSizes field of the optional header should also be used to ensure that no probe for a particular data directory entry goes beyond the optional header. Note that the size of the optional header is not fixed. An object file can have an optional header, but generally this header has no function in an object file except to increase its size. For image files, this header is required. This header is optional in the sense that some files specifically, object files do not have it. Every image file has an optional header that provides information to the loader. The following flags are currently defined. The Characteristics field contains flags that indicate attributes of the object or image file. An image file can be run only on the specified machine or on a system that emulates the specified machine. Note that the Windows loader limits the number of sections to The Machine field has one of the following values that specifies its CPU type. After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file as a PE format image file.ДЄt the beginning of an object file, or immediately after the signature of an image file, is a standard COFF file header in the following format. This file offset is placed at location 0x3c during linking. At location 0x3c, the stub has the file offset to the PE signature. It is placed at the front of the EXE image. In both cases, the file headers are followed immediately by section headers. The following list describes the Microsoft PE executable format, with the base of the image header at the top. The name 'Portable Executable' refers to the fact that the format is not architecture specific. This document specifies the structure of executable image files and object files under the Microsoft Windows family of operating systems.

Microsoft reserves the right to alter this document without notice. This document is provided to aid in the development of tools and applications for Windows but is not guaranteed to be a complete specification in all respects. This specification describes the structure of executable image files and object files under the Windows family of operating systems.

Pe explorer cnet