Mastering Assembly Programming

Headers

A PE file contains several headers and the first one we encounter is the DOS header, which only contains two things that are interesting for us; the first is the MZ signature and the second is the offset of the file header, also known as the PE header (as it is preceded by the PE\x0\x0 signature). The file header contains basic information about the file such as, for example, the number of sections.

Following the PE header is the optional header, which, in turn, contains even more interesting information such as ImageBase, --the address at which the image (file) should preferably be loaded, --and NumberOfRvaAndSizes, and the latter is of special interest for us. The NumberOfRvaAndSizes field denotes the number of entries in the array ...