64 bit
0 1 2 3 4 5 6 7
Signature 0x5A4D
DOS Header
(0x3C) Pointer to PE Header
DOS STUB
0x0000 Signature 0x50450000 Machine #NumberOfSections
PointerToSymbolTable COFF
0x0008 TimeDateStamp (deprecated) Header
0x0010 # NumberOfSymbolTable SizeOfOptionalHeader Characteristics
(deprecated)
0x0018 Magic MajorLinker MinorLinker SizeOfCode
Version Version (sum of all sections)
Standard
0x0020 SizeOfInitializedData SizeOfUninitializedData COFF
Fields
0x0028 AddressOfEntryPoint BaseOfCode
(RVA) (RVA)
0x0030 BaseOfData ImageBase
(RVA)
0x0038 SectionAlignment FileAlignment
MajorOperating MinorOperating MajorImage MinorImage
0x0040 SystemVersion SystemVersion Version Version
0x0048 MajorSubsystem MinorSubsystem Win32VersionValue
Version Version (zeros filled)
Windows
0x0050 SizeOfImage SizeOfHeaders Specific
Fields
0x0058 CheckSum Subsystem DllCharacteristics
(images not checked)
0x0060 SizeOfStackReserve SizeOfStackCommit
0x0068 SizeOfHeapReserve SizeOfHeapCommit
0x0070 LoaderFlags # NumberOfRvaAndSizes
(zeros filled)
ExportTable SizeOfExportTable
(RVA)
ImportTable SizeOfImportTable
(RVA) Optional
ResourceTable SizeOfResourceTable Header
(RVA)
ExceptionTable SizeOfExceptionTable
(RVA)
CertificateTable SizeOfCertificateTable
(RVA)
BaseRelocationTable SizeOfBaseRelocationTable
(RVA)
Debug SizeOfDebug
(RVA)
ArchitectureData SizeOfArchitectureData
(RVA)
Data
GlobalPtr 00 00 00 00 Directories
(RVA)
TLSTable SizeOfTLSTable
(RVA)
LoadConfigTable SizeOfLoadConfigTable
(RVA)
BoundImport SizeOfBoundImport
(RVA)
ImportAddressTable SizeOfImportAddressTable
(RVA)
DelayImportDescriptor SizeOfDelayImportDescriptor
(RVA)
CLRRuntimeHeader SizeOfCLRRuntimeHeader
(RVA)
00 00 00 00 00 00 00 00
Name
VirtualAddress Section
VirtualSize (RVA) Table
SizeOfRawData PointerToRawData
PointerToRelocations PointerToLinenumbers
NumberOfRelocations NumberOfLinenumbers Characteristics
