True if member is within SizeOfOptionalHeader bytes
The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero.
Reserved, must be 0
The address that is relative to the image base of the beginning-of-code section when it is loaded into memory.
The base relocation table address and size. For more information, see section 6.6, "The .reloc Section (Image Only)."
The bound import table address and size.
The CLR runtime header address and size. For more information, see section 6.10, “The .cormeta Section (Object Only).”
The attribute certificate table address and size. For more information, see section 5.7, “The Attribute Certificate Table (Image Only).”
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.
The debug data starting address and size. For more information, see section 6.1, “The .debug Section.”
The delay import descriptor address and size. For more information, see section 5.8, “DelayLoad Import Tables (Image Only).”
For more information, see “DLL Characteristics” later in this specification.
The exception table address and size. For more information, see section 6.5, “The .pdata Section.”
The export table address and size. For more information see section 6.3, “The .edata Section (Image Only).”
The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the architecture’s page size, then FileAlignment must match SectionAlignment.
The RVA of the value to be stored in the global pointer register. The size member of this structure must be set to zero.
The import address table address and size. For more information, see section 6.4.4, “Import Address Table.”
The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
The import table address and size. For more information, see section 6.4, “The .idata Section.”
The load configuration table address and size. For more information, see section 6.8, “The Load Configuration Structure (Image Only).”
Reserved, must be zero.
The unsigned integer that identifies the state of the image file. The most common number is 0x10B, which identifies it as a normal executable file. 0x107 identifies it as a ROM image, and 0x20B identifies it as a PE32+ executable.
The major version number of the image.
The linker major version number.
The major version number of the required operating system.
The major version number of the subsystem.
The minor version number of the image.
The linker minor version number.
The minor version number of the required operating system.
The minor version number of the subsystem.
The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
The resource table address and size. For more information, see section 6.9, “The .rsrc Section.”
The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to FileAlignment. The default is the page size for the architecture.
The size of the code (text) section, or the sum of all code sections if there are multiple sections.
The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
The size of the local heap space to commit.
The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one page at a time until the reserve size is reached.
The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of SectionAlignment.
The size of the initialized data section, or the sum of all such sections if there are multiple data sections.
The size of the stack to commit.
The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a time until the reserve size is reached.
The size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.
The subsystem that is required to run this image. For more information, see “Windows Subsystem” later in this specification.
The thread local storage (TLS) table address and size. For more information, see section 6.7, “The .tls Section.”
Reserved, must be zero.
Reserved, must be zero
Optional Header (Image Only)
Every image file has an optional header that provides information to the loader. This header is optional in the sense that some files (specifically, object files) do not have it. For image files, this header is required. An object file can have an optional header, but generally this header has no function in an object file except to increase its size. Note that the size of the optional header is not fixed. The SizeOfOptionalHeader field in the COFF header must be used to validate that a probe into the file for a particular data directory does not go beyond SizeOfOptionalHeader. For more information, see section 3.3, “COFF File Header (Object and Image).” The NumberOfRvaAndSizes field of the optional header should also be used to ensure that no probe for a particular data directory entry goes beyond the optional header. In addition, it is important to validate the optional header magic number for format compatibility. The optional header magic number determines whether an image is a PE32 or PE32+ executable. | Magic number + PE format | 0x10b | PE32 | 0x20b | PE32+ PE32+ images allow for a 64-bit address space while limiting the image size to 2 gigabytes. Other PE32+ modifications are addressed in their respective sections. The optional header itself has three major parts
struct defines PE32+