PE Header Decoder

What Is a PE Header?

PE stands for Portable Executable. It is the executable file format used by modern Windows for applications, DLLs, drivers and several other binary image types.

The PE format builds on the COFF object-file format and normally appears after a legacy DOS header and DOS stub.

Windows MZ Header

Most PE executable files begin with the two-byte DOS signature:

This is why Windows executables are often described as MZ/PE files.

What Is e_lfanew?

The DOS header field at file offset 0x3C contains a 32-bit little-endian value named e_lfanew. It points to the PE signature.

For example, if e_lfanew is 0x80, the four-byte PE signature should begin at file offset 0x80.

PE Signature

The Portable Executable signature is:

The 20-byte COFF File Header immediately follows this signature.

PE COFF File Header

PE Machine Types

NumberOfSections

The COFF NumberOfSections field reports how many section-table entries follow the PE headers.

Typical section names can include .text, .data, .rdata, .rsrc, .reloc and others, although section names are not required to use those exact labels.

PE TimeDateStamp

The COFF TimeDateStamp field is traditionally represented as a 32-bit value using Unix-style seconds from the epoch.

Toolchains may assign special, reproducible or otherwise non-wall-clock values, so the field should not always be assumed to prove an exact compilation time.

PE32 vs PE32+

The Optional Header Magic field distinguishes the two common PE image formats.

The plus sign in PE32+ does not mean the Optional Header is simply a larger copy of PE32. Several fields differ, including ImageBase and stack/heap sizes, and BaseOfData is absent.

AddressOfEntryPoint

AddressOfEntryPoint contains the relative virtual address, or RVA, of the starting code location when an entry point exists.

The field itself is an RVA, not normally a raw file offset.

PE ImageBase

ImageBase is the preferred virtual address where Windows loads the image. PE32 uses a 32-bit ImageBase while PE32+ uses a 64-bit field.

Address Space Layout Randomization can cause the actual runtime address to differ from the preferred image base.

SectionAlignment

SectionAlignment specifies the alignment of sections when loaded into virtual memory.

FileAlignment

FileAlignment specifies section alignment in the PE file on disk. A common value is 0x200, or 512 bytes.

SizeOfImage

SizeOfImage represents the total image size in memory, including headers and sections, rounded according to SectionAlignment.

It is not necessarily equal to the number of bytes in the executable file on disk.

SizeOfHeaders

SizeOfHeaders covers the DOS header, PE signature, PE headers and section-table area rounded according to FileAlignment.

Windows PE Subsystem

The Subsystem field indicates the execution environment expected by the binary.

DLL Characteristics

DLL Characteristics contains image-loading and security-related flags. Despite its name, the field appears in PE executable images generally, not only DLLs.

Common flags include ASLR-related dynamic base support, NX compatibility, high-entropy virtual-address support and Control Flow Guard support.

Common DLL Characteristics Flags

PE Characteristics Field

The COFF Characteristics field contains flags describing the image and object properties.

PE Data Directories

The Optional Header ends with an array of data-directory entries. Each directory normally contains an RVA and size.

Common directory indexes include Export Table, Import Table, Resource Table, Exception Table, Base Relocation Table, Debug Directory, TLS Table and Import Address Table.

PE Header vs Section Table

The PE and Optional Headers describe the image globally. The section table follows the Optional Header and contains one 40-byte IMAGE_SECTION_HEADER entry for each section.

This tool focuses on the PE headers themselves rather than performing a full section-by-section executable analysis.

PE Header Decoder FAQs