August 2019
Intermediate to advanced
342 pages
9h 35m
English
PE specification is derived from the Unix Common Object File Format (COFF) and it is basically a data structure that covers the information necessary for the Windows OS loader to manage the executable image, that is, when its structures get mapped into runtime memory before getting executed by the OS.
Simply put, a PE file consists of a PE file header and a section table (section headers), followed by the sections' data.
The PE file header is encapsulated in the Windows NT header structure (defined in the winnt.h header file, along with other C structures) and is composed of the following:
The file headers are followed by section headers ...
Read now
Unlock full access