Portable Executable

From Just Solve the File Format Problem
(Difference between revisions)
Jump to: navigation, search
(Added Kaitai Struct link)
(Import libraries are part of the PE-COFF specifications)
Line 2: Line 2:
 
|formattype=electronic
 
|formattype=electronic
 
|subcat=Executables
 
|subcat=Executables
|extensions={{ext|exe}}, {{ext|dll}}, {{ext|cpl}}, {{ext|efi}}, {{ext|ocx}}, {{ext|scr}}, {{ext|sys}}, others
+
|extensions={{ext|exe}}, {{ext|dll}}, {{ext|cpl}}, {{ext|efi}}, {{ext|ocx}}, {{ext|scr}}, {{ext|sys}}, {{ext|lib}}, others
 
|pronom={{PRONOM|x-fmt/411}}, {{PRONOM|fmt/899}}, {{PRONOM|fmt/900}}
 
|pronom={{PRONOM|x-fmt/411}}, {{PRONOM|fmt/899}}, {{PRONOM|fmt/900}}
 
|kaitai struct=microsoft_pe
 
|kaitai struct=microsoft_pe
Line 33: Line 33:
 
* [https://github.com/katjahahn/PortEx/tree/master/progs PortEx Analyzer]
 
* [https://github.com/katjahahn/PortEx/tree/master/progs PortEx Analyzer]
 
* [http://bytepointer.com/tools/index.htm#pelook pelook]
 
* [http://bytepointer.com/tools/index.htm#pelook pelook]
 +
* [https://implib.sourceforge.io/ ImpLib SDK]
  
 
== Other links ==
 
== Other links ==

Revision as of 03:05, 20 June 2021

File Format
Name Portable Executable
Ontology
Extension(s) .exe, .dll, .cpl, .efi, .ocx, .scr, .sys, .lib, others
PRONOM x-fmt/411, fmt/899, fmt/900
Kaitai Struct Spec microsoft_pe.ksy

Portable Executable (PE, PE/COFF, PE32, PE32+) is a member of the EXE family of executable file formats. It is used by the Microsoft Windows family of operating systems (starting with Windows 95 and Win32s), EFI and sometimes in other environments. It is an extension/hybrid of MS-DOS EXE, and a successor to NE. Parts of it are derived from COFF.

Despite the name, not all PE files are executable. Some contain only icons, fonts, etc.

Contents

Formats

  • PE32 format is used by 32-bit Windows.
  • PE32+ format is used by 64-bit Windows.

Identification

A PE file begins with the ASCII signature "MZ". At offset 60 is a 4-byte integer pointing to an "extended" header that begins with 'P' 'E' 0x00 0x00. For more information, see MS-DOS EXE.

See also

Specifications and technical information

Software and tools

Other links

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox