What Is The PE Header?
- The PE header contains the information the OS requires to run the executable.
- This information is very useful, as it can give us more information about the functionality of the malware and how the malware interacts with the OS.
Why is the PE header important?
- It contains all of the important and necessary information required by the OS to execute the executable.
- It contains information that specifies where the executable needs to be loaded in to memory.
- It contains the libraries that the executable requires to be loaded (dll).
- It contains information that specifies where the execution begins.
PE Header Structure
|MZ Header/DOS Header|
(Program cannot be run in DOS mode)
|PE File Header (Signature)|
|Image Optional Header|
|.code / .text||Executable code|
|.data||Stores Data (R/W)|
|.rdata||Stores Data (Read Only)|
|.idata||Stores The Import Table|
|.edata||Stores Export Data|
|.rsrc||Stores Resources (Strings, icons)|