Portable Executable
From Just Solve the File Format Problem
(Difference between revisions)
(Created page with "{{FormatInfo |formattype=electronic |subcat=Executables |extensions={{ext|exe}}, others }} '''PE''' ('''Portable Executable''', also called '''PE/COFF''') is a family of execu...") |
|||
| Line 4: | Line 4: | ||
|extensions={{ext|exe}}, others | |extensions={{ext|exe}}, others | ||
}} | }} | ||
| − | '''PE''' ('''Portable Executable''', also called '''PE/COFF''') is a family of executable file formats mainly used by Microsoft Windows. It is | + | '''PE''' ('''Portable Executable''', also called '''PE/COFF''') is a member of the [[EXE]] family of executable file formats. It is used mainly used by 32- and 64-bit Microsoft Windows operating systems. It is an extension/hybrid of [[MS-DOS EXE]], and a successor to [[NE]]. Parts of it are derived from [[COFF]]. |
Despite the name, not all PE files are executable. Some contain only icons, fonts, etc. | Despite the name, not all PE files are executable. Some contain only icons, fonts, etc. | ||
| Line 13: | Line 13: | ||
== Identification == | == Identification == | ||
| − | A PE file begins with the ASCII signature "<code>MZ</code>" | + | A PE file begins with the ASCII signature "<code>MZ</code>". At offset 60 is a 4-byte integer pointing to an "extended" header that begins with <code>'P' 'E' 0x00 0x00</code>. For more information, see [[MS-DOS EXE]]. |
== Links == | == Links == | ||
Revision as of 02:27, 9 May 2014
PE (Portable Executable, also called PE/COFF) is a member of the EXE family of executable file formats. It is used mainly used by 32- and 64-bit Microsoft Windows operating systems. It is an extension/hybrid of MS-DOS EXE, and a successor to NE. Parts of it are derived from COFF.
Despite the name, not all PE files are executable. Some contain only icons, fonts, etc.
Formats
- PE32 format is used by 32-bit Windows.
- PE32+ format is used by 64-bit Windows.
Identification
A PE file begins with the ASCII signature "MZ". At offset 60 is a 4-byte integer pointing to an "extended" header that begins with 'P' 'E' 0x00 0x00. For more information, see MS-DOS EXE.
Links
- Wikipedia article
- PE, from the OSDev Wiki
- Microsoft PE and COFF Specification
- Article on the PE format as used by Windows NT 3, by Johannes Plachy
- Forensics Wiki: Portable Executable Format
