Windows PE Executable Format

The Portable Executable (PE) format is the standard executable file format for Windows (including .exe, .dll, .sys).

Core Components

A PE file consists of a series of headers followed by sections containing code, data, and resources.

1. DOS Header & Stub

Every PE file starts with a legacy DOS header (magic number MZ, 0x4D 0x5A). It contains a tiny MS-DOS program that prints "This program cannot be run in DOS mode." if executed on a legacy system. The last field of this header points to the actual PE header.

2. PE Header (COFF Header)

Begins with the signature PE (0x50 0x45 0x00 0x00). It contains essential information such as the target machine architecture (x86, x64), number of sections, and timestamp.

3. Optional Header

Despite its name, it is mandatory for executables. It contains the Entry Point (where execution begins), memory alignment settings, and the Data Directories array (pointers to import/export tables, resources, etc.).

4. Section Headers & Sections

The file is divided into sections:

• .text: Executable code (instructions).
• .data: Initialized global variables.
• .bss: Uninitialized global variables.
• .rdata: Read-only data (strings, constants).
• .rsrc: Resources (icons, dialogs, version info).

Forensic Analysis

Analysts look for anomalies in PE headers:

• High Entropy Sections: Indicate packing or encryption (often in .text or a custom section name).
• Suspicious Imports: If an executable only imports LoadLibrary and GetProcAddress, it is likely unpacking malicious code at runtime.
• Timestomping: Compiling timestamps that are in the future or deliberately set to 1970.