Portable Executable

File Format
Name	Portable Executable
Ontology	Electronic File Formats Executables Portable Executable
Extension(s)	.exe, .dll, others

PE (Portable Executable, also called PE/COFF) is a member of the EXE family of executable file formats. It is used mainly used by 32- and 64-bit Microsoft Windows operating systems. It is an extension/hybrid of MS-DOS EXE, and a successor to NE. Parts of it are derived from COFF.

Despite the name, not all PE files are executable. Some contain only icons, fonts, etc.

Formats

• PE32 format is used by 32-bit Windows.
• PE32+ format is used by 64-bit Windows.

Identification

A PE file begins with the ASCII signature "MZ". At offset 60 is a 4-byte integer pointing to an "extended" header that begins with 'P' 'E' 0x00 0x00. For more information, see MS-DOS EXE.

Links

• Wikipedia article
• PE, from the OSDev Wiki
• Microsoft PE and COFF Specification
• Article on the PE format as used by Windows NT 3, by Johannes Plachy
• Forensics Wiki: Portable Executable Format
• PE (corkami.com)
  • PE102 - a Windows executable format overview
  • PE101 - a Windows executable walkthrough