> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/malware-development/pe-format/overview.md).

# Overview

## PE Files

**PE** stands for **Portable Executable**, it's a file format for executables used in Windows operating systems, it's based on **COFF (Common Object File Format)**.

Not only `.exe` files are PE files, dynamic link libraries (`.dll`), kernel modules (`.srv`), Control Panel applications (`.cpl`) and many others are also PE files.

A PE file is a data structure that holds information necessary for the OS loader to be able to load that executable into memory and execute it.

## Structure Overview

A typical PE file follows the structure outlined in the following figure:

![PE file structure](https://3988450783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVjG_njKgBtvmnKaJh%2Fuploads%2FQEnEI42k3XaaF02ibOGw%2Fimage.png?alt=media\&token=b72de976-204d-4521-88be-00640832a9b9)

In PEBear:

![An exe file opened in PEBear](https://3988450783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVjG_njKgBtvmnKaJh%2Fuploads%2F6ayalpN0DOmQ1HBAJ6Zo%2Fimage.png?alt=media\&token=d3e47d3e-91a8-4d1d-bca6-52fc33708149)

* **DOS header**
  * Every PE file starts with a 64-bytes-long structure called the DOS header, it's what makes the PE file an MS-DOS executable.
* **DOS stub**
  * After the DOS header comes the DOS stub which is a small MS-DOS 2.0 compatible executable that just prints an error message saying "This program cannot be run in DOS mode" when the program is run in DOS mode.
* **NT headers**
  * The NT Headers part contains three main parts:
  * *Signature*
    * A 4-byte signature that identifies the file as a PE file.
  * *File Header*
    * A standard COFF File Header. It holds some information about the PE file.
  * *Optional Header*
    * The most important header of the NT Headers, its name is the Optional Header because some files like object files don't have it, however it's required for image files (files like `.exe` files). This header provides important information to the OS loader.
* **Section table**
  * The section table follows the Optional Header immediately, it is an array of Image Section Headers, there's a section header for every section in the PE file.
  * Each header contains information about the section it refers to.
* **Sections**
  * Sections are where the actual contents of the file are stored, these include things like data (`.data`) and resources (`.rsrc`) that the program uses, and also the actual code of the program (`.text`), there are several sections each one with its own purpose.

## Reference

{% embed url="<https://0xrick.github.io/win-internals/pe2/>" %}
A dive into the PE file format - PE file structure - Part 1: Overview
{% endembed %}