PE Windows Binary Utility

PE Header Decoder

Decode Windows Portable Executable headers from hexadecimal bytes. Parse the DOS MZ header, PE signature, COFF File Header, PE32 or PE32+ Optional Header, machine architecture, entry point, image base, subsystem, alignment, image size and executable characteristics.

✓ PE32 ✓ PE32+ ✓ EXE / DLL ✓ x86 / x64 ✓ ARM / ARM64 ✓ Entry Point

Portable Executable Header Decoder

● Ready

PE / EXE Header Hex Bytes Paste a complete PE header beginning with 50 45 00 00, or paste the beginning of a full Windows executable beginning with 4D 5A. Spaces, commas, colons, hyphens and continuous hexadecimal are accepted.

Input Starting Point Auto mode recognizes either an MZ executable image or a direct PE header dump.

COFF Timestamp Display

PE layout: a normal Windows executable starts with the DOS signature MZ. The DOS field at offset 0x3C, called e_lfanew, contains the file offset of the PE\0\0 signature. A direct PE header dump can instead begin immediately with 50 45 00 00.

PE Header Decode Result Decoded

Decoded Windows Binary —

PE Signature —

PE Format —

Machine —

Sections —

Timestamp —

Characteristics —

Entry Point RVA —

Image Base —

Section Alignment —

File Alignment —

Size of Image —

Size of Headers —

Subsystem —

DLL Characteristics —

Data Directories —

PE Offset —

COFF File Header —

Optional Header —

Calculation Breakdown —

What Is a PE Header?

PE stands for Portable Executable. It is the executable file format used by modern Windows for applications, DLLs, drivers and several other binary image types.

The PE format builds on the COFF object-file format and normally appears after a legacy DOS header and DOS stub.

Windows MZ Header

Most PE executable files begin with the two-byte DOS signature:

4D 5A

ASCII:
M Z

This is why Windows executables are often described as MZ/PE files.

What Is e_lfanew?

The DOS header field at file offset 0x3C contains a 32-bit little-endian value named e_lfanew. It points to the PE signature.

PE Offset =

DWORD at file offset 0x3C

For example, if e_lfanew is 0x80, the four-byte PE signature should begin at file offset 0x80.

PE Signature

The Portable Executable signature is:

50 45 00 00

ASCII:
P E \0 \0

The 20-byte COFF File Header immediately follows this signature.

PE COFF File Header

PE Signature:
4 bytes

COFF File Header:
20 bytes

Fields include:

Machine
NumberOfSections
TimeDateStamp
PointerToSymbolTable
NumberOfSymbols
SizeOfOptionalHeader
Characteristics

PE Machine Types

Machine	Value	Architecture
I386	0x014C	Intel x86
AMD64	0x8664	x86-64
ARM	0x01C0	ARM
ARMNT	0x01C4	ARM Thumb-2
ARM64	0xAA64	AArch64 / ARM64
IA64	0x0200	Intel Itanium
RISCV32	0x5032	RISC-V 32
RISCV64	0x5064	RISC-V 64

NumberOfSections

The COFF NumberOfSections field reports how many section-table entries follow the PE headers.

Typical section names can include .text, .data, .rdata, .rsrc, .reloc and others, although section names are not required to use those exact labels.

PE TimeDateStamp

The COFF TimeDateStamp field is traditionally represented as a 32-bit value using Unix-style seconds from the epoch.

Toolchains may assign special, reproducible or otherwise non-wall-clock values, so the field should not always be assumed to prove an exact compilation time.

PE32 vs PE32+

The Optional Header Magic field distinguishes the two common PE image formats.

Magic	Format	Typical Architecture
0x010B	PE32	32-bit
0x020B	PE32+	64-bit
0x0107	ROM image	Special case

The plus sign in PE32+ does not mean the Optional Header is simply a larger copy of PE32. Several fields differ, including ImageBase and stack/heap sizes, and BaseOfData is absent.

AddressOfEntryPoint

AddressOfEntryPoint contains the relative virtual address, or RVA, of the starting code location when an entry point exists.

Virtual Entry Address ≈

ImageBase
+
AddressOfEntryPoint

The field itself is an RVA, not normally a raw file offset.

PE ImageBase

ImageBase is the preferred virtual address where Windows loads the image. PE32 uses a 32-bit ImageBase while PE32+ uses a 64-bit field.

Common historical examples:

32-bit EXE:
0x00400000

64-bit EXE:
0x0000000140000000

Address Space Layout Randomization can cause the actual runtime address to differ from the preferred image base.

SectionAlignment

SectionAlignment specifies the alignment of sections when loaded into virtual memory.

Typical value:

0x1000
= 4096 bytes

FileAlignment

FileAlignment specifies section alignment in the PE file on disk. A common value is 0x200, or 512 bytes.

SectionAlignment:
0x1000

FileAlignment:
0x0200

SizeOfImage

SizeOfImage represents the total image size in memory, including headers and sections, rounded according to SectionAlignment.

It is not necessarily equal to the number of bytes in the executable file on disk.

SizeOfHeaders

SizeOfHeaders covers the DOS header, PE signature, PE headers and section-table area rounded according to FileAlignment.

Windows PE Subsystem

The Subsystem field indicates the execution environment expected by the binary.

Value	Subsystem
1	Native
2	Windows GUI
3	Windows Console
7	POSIX CUI
9	Windows CE GUI
10	EFI Application
11	EFI Boot Service Driver
12	EFI Runtime Driver
14	Xbox
16	Windows Boot Application

DLL Characteristics

DLL Characteristics contains image-loading and security-related flags. Despite its name, the field appears in PE executable images generally, not only DLLs.

Common flags include ASLR-related dynamic base support, NX compatibility, high-entropy virtual-address support and Control Flow Guard support.

Common DLL Characteristics Flags

Flag	Meaning
0x0020	High Entropy VA
0x0040	Dynamic Base
0x0080	Force Integrity
0x0100	NX Compatible
0x0200	No Isolation
0x0400	No SEH
0x0800	No Bind
0x1000	AppContainer
0x2000	WDM Driver
0x4000	Control Flow Guard
0x8000	Terminal Server Aware

PE Characteristics Field

The COFF Characteristics field contains flags describing the image and object properties.

Common examples:

0x0002
Executable image

0x0020
Large address aware

0x2000
DLL

0x0100
32-bit machine

PE Data Directories

The Optional Header ends with an array of data-directory entries. Each directory normally contains an RVA and size.

Common directory indexes include Export Table, Import Table, Resource Table, Exception Table, Base Relocation Table, Debug Directory, TLS Table and Import Address Table.

PE Header vs Section Table

The PE and Optional Headers describe the image globally. The section table follows the Optional Header and contains one 40-byte IMAGE_SECTION_HEADER entry for each section.

This tool focuses on the PE headers themselves rather than performing a full section-by-section executable analysis.

PE Header Decoder FAQs

What are the first bytes of a Windows EXE?

A normal PE executable begins with 4D 5A, the MZ DOS signature.

What is the PE signature?

The Portable Executable signature is 50 45 00 00, representing PE followed by two zero bytes.

Where is e_lfanew?

e_lfanew is a 32-bit little-endian field at DOS-header offset 0x3C that points to the PE signature.

What does PE Optional Header magic 0x10B mean?

0x010B identifies the PE32 Optional Header format.

What does 0x20B mean?

0x020B identifies PE32+, the format commonly used by 64-bit Windows images.

What machine value identifies x86-64?

IMAGE_FILE_MACHINE_AMD64 is 0x8664.

What machine value identifies x86?

IMAGE_FILE_MACHINE_I386 is 0x014C.

What machine value identifies ARM64?

IMAGE_FILE_MACHINE_ARM64 is 0xAA64.

Is AddressOfEntryPoint a file offset?

No. It is normally a relative virtual address relative to the loaded image base.

Can I paste only the PE header without the DOS header?

Yes. Auto mode recognizes input beginning directly with 50 45 00 00 and treats the PE signature as offset zero.

Decode Windows PE Executable Headers

Inspect raw EXE, DLL and Windows binary headers from hex dumps, malware-analysis labs, compilers, debuggers, reverse-engineering tools and firmware packages with automatic PE32 and PE32+ decoding.