PE File Internals

PE FILE ON DISK
──────────────────────────────────────────────────────────────────────────────

Offset 0x00
┌──────────────────────────────────────────────────────────────┐
│ DOS Header                                                   │
│   • 64 bytes                                                 │
│   • Starts with "MZ"                                         │
├──────────────────────────────────────────────────────────────┤
│ DOS Stub                                                     │
│   • "This program cannot be run in DOS mode"                 │
├──────────────────────────────────────────────────────────────┤
│ Rich Header (optional)                                       │
│   • Undocumented Microsoft compiler metadata                 │
├──────────────────────────────────────────────────────────────┤
│ NT Headers                                                   │
│   • Signature ("PE\0\0")                                     │
│   • IMAGE_FILE_HEADER                                        │
│   • IMAGE_OPTIONAL_HEADER                                    │
├──────────────────────────────────────────────────────────────┤
│ Section Headers                                              │
│   • Array of IMAGE_SECTION_HEADER structures                 │
├──────────────────────────────────────────────────────────────┤
│ Section Data (Raw File Data)                                 │
│   • .text                                                    │
│   • .data                                                    │
│   • .rdata                                                   │
│   • .rsrc                                                    │
│   • .reloc                                                   │
│   • ...                                                      │
└──────────────────────────────────────────────────────────────┘

                     ^
                     |
                  e_lfanew

PE FILE IN MEMORY (After Windows Loader Maps It)
──────────────────────────────────────────────────────────────────────────────

ImageBase
┌──────────────────────────────────────────────────────────────┐
│ DOS Header                                                   │
├──────────────────────────────────────────────────────────────┤
│ NT Headers                                                   │
├──────────────────────────────────────────────────────────────┤
│ Section Headers                                              │
├──────────────────────────────────────────────────────────────┤
│ .text   (Executable Code)                                    │
│          Aligned to SectionAlignment                         │
├──────────────────────────────────────────────────────────────┤
│ .rdata  (Read-Only Data)                                     │
├──────────────────────────────────────────────────────────────┤
│ .data   (Writable Data)                                      │
├──────────────────────────────────────────────────────────────┤
│ .rsrc   (Resources)                                          │
├──────────────────────────────────────────────────────────────┤
│ .reloc  (Base Relocation Table, if present)                  │
└──────────────────────────────────────────────────────────────┘

typedef struct _IMAGE_DOS_HEADER {
    WORD  e_magic;      // 0x00 — Magic number: 0x5A4D ("MZ")
    WORD  e_cblp;       // 0x02 — Bytes on last page of file
    WORD  e_cp;         // 0x04 — Pages in file
    WORD  e_crlc;       // 0x06 — Relocations
    WORD  e_cparhdr;    // 0x08 — Size of header in paragraphs
    WORD  e_minalloc;   // 0x0A — Minimum extra paragraphs needed
    WORD  e_maxalloc;   // 0x0C — Maximum extra paragraphs needed
    WORD  e_ss;         // 0x0E — Initial (relative) SS value
    WORD  e_sp;         // 0x10 — Initial SP value
    WORD  e_csum;       // 0x12 — Checksum
    WORD  e_ip;         // 0x14 — Initial IP value
    WORD  e_cs;         // 0x16 — Initial (relative) CS value
    WORD  e_lfarlc;     // 0x18 — File address of relocation table
    WORD  e_ovno;       // 0x1A — Overlay number
    WORD  e_res;     // 0x1C — Reserved words[1]
    WORD  e_oemid;      // 0x24 — OEM identifier
    WORD  e_oeminfo;    // 0x26 — OEM information
    WORD  e_res2;   // 0x28 — Reserved words[2]
    LONG  e_lfanew;     // 0x3C — ★ File offset of PE Header (NT Headers)
} IMAGE_DOS_HEADER;

import pefile
pe = pefile.PE("sample.exe")
print(hex(pe.DOS_HEADER.e_magic))    # 0x5a4d
print(hex(pe.DOS_HEADER.e_lfanew))   # e.g. 0xf0

# Parse Rich Header with pefile
import pefile
pe = pefile.PE("sample.exe")
if hasattr(pe, 'RICH_HEADER'):
    print(pe.RICH_HEADER)
    for entry in pe.RICH_HEADER.values:
        print(f"  ProductID: {entry:#06x}  Build: {entry}  Count: {entry}")[3][4]

typedef struct _IMAGE_NT_HEADERS {
    DWORD                 Signature;      // 0x00 — "PE\0\0" = 0x00004550
    IMAGE_FILE_HEADER     FileHeader;     // 0x04 — COFF File Header (20 bytes)
    IMAGE_OPTIONAL_HEADER OptionalHeader; // 0x18 — Optional Header (96/112+ bytes)
} IMAGE_NT_HEADERS;

print(hex(pe.NT_HEADERS.Signature))        # 0x4550 (PE)
print(pe.FILE_HEADER.Machine)              # 0x14c = x86, 0x8664 = x64
print(hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint))

typedef struct _IMAGE_FILE_HEADER {
    WORD  Machine;              // 0x00 — Target CPU architecture
    WORD  NumberOfSections;     // 0x02 — Number of section headers
    DWORD TimeDateStamp;        // 0x04 — Unix timestamp of link time
    DWORD PointerToSymbolTable; // 0x08 — Offset to COFF symbol table (usually 0)
    DWORD NumberOfSymbols;      // 0x0C — Number of symbols (usually 0)
    WORD  SizeOfOptionalHeader; // 0x10 — Size of Optional Header
    WORD  Characteristics;      // 0x12 — Flags describing the file
} IMAGE_FILE_HEADER;

print(pe.FILE_HEADER.NumberOfSections)   # e.g. 5
print(pe.FILE_HEADER.TimeDateStamp)      # Unix timestamp
import datetime
ts = datetime.datetime.utcfromtimestamp(pe.FILE_HEADER.TimeDateStamp)
print(ts)   # e.g. 2019-06-13 12:34:56
# Malware often zeros or fakes this timestamp

typedef struct _IMAGE_OPTIONAL_HEADER {
    // ── Standard Fields ──────────────────────────────────────────
    WORD  Magic;                    // 0x000 — 0x010B = PE32, 0x020B = PE32+
    BYTE  MajorLinkerVersion;       // 0x002
    BYTE  MinorLinkerVersion;       // 0x003
    DWORD SizeOfCode;               // 0x004 — Total size of code sections
    DWORD SizeOfInitializedData;    // 0x008
    DWORD SizeOfUninitializedData;  // 0x00C
    DWORD AddressOfEntryPoint;      // 0x010 — ★ RVA of entry point (OEP)
    DWORD BaseOfCode;               // 0x014 — RVA of start of .text
    DWORD BaseOfData;               // 0x018 — RVA of start of .data (PE32 only)

    // ── Windows-Specific Fields ──────────────────────────────────
    DWORD ImageBase;                // 0x01C — ★ Preferred load VA (0x400000 default)
    DWORD SectionAlignment;         // 0x020 — Section alignment in memory (0x1000)
    DWORD FileAlignment;            // 0x024 — Raw section alignment on disk (0x200)
    WORD  MajorOSVersion;           // 0x028
    WORD  MinorOSVersion;           // 0x02A
    WORD  MajorImageVersion;        // 0x02C
    WORD  MinorImageVersion;        // 0x02E
    WORD  MajorSubsystemVersion;    // 0x030
    WORD  MinorSubsystemVersion;    // 0x032
    DWORD Win32VersionValue;        // 0x034 — Reserved, must be 0
    DWORD SizeOfImage;              // 0x038 — ★ Total size of image in memory
    DWORD SizeOfHeaders;            // 0x03C — Size of all headers + section table
    DWORD CheckSum;                 // 0x040 — CRC checksum (required for drivers)
    WORD  Subsystem;                // 0x044 — Windows / Console / Native etc.
    WORD  DllCharacteristics;       // 0x046 — Security flags (ASLR, NX, CFG etc.)
    DWORD SizeOfStackReserve;       // 0x048
    DWORD SizeOfStackCommit;        // 0x04C
    DWORD SizeOfHeapReserve;        // 0x050
    DWORD SizeOfHeapCommit;         // 0x054
    DWORD LoaderFlags;              // 0x058 — Obsolete
    DWORD NumberOfRvaAndSizes;      // 0x05C — Number of Data Directory entries (16)

    // ── Data Directory ───────────────────────────────────────────
    IMAGE_DATA_DIRECTORY DataDirectory; // 0x060[5]
} IMAGE_OPTIONAL_HEADER32;

print(hex(pe.OPTIONAL_HEADER.Magic))                # 0x10b or 0x20b
print(hex(pe.OPTIONAL_HEADER.ImageBase))            # e.g. 0x400000
print(hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint))  # OEP RVA
print(pe.OPTIONAL_HEADER.Subsystem)                 # 2=GUI, 3=Console
print(hex(pe.OPTIONAL_HEADER.DllCharacteristics))   # security flags

# Iterate all data directories
for entry in pe.OPTIONAL_HEADER.DATA_DIRECTORY:
    if entry.VirtualAddress:
        print(f"  {entry.name:<50} RVA={entry.VirtualAddress:#010x}  Size={entry.Size:#010x}")

typedef struct _IMAGE_SECTION_HEADER {
    BYTE  Name;                // 0x00 — Section name (null-padded, NOT null-terminated)[6]
    union {
        DWORD PhysicalAddress;
        DWORD VirtualSize;        // 0x08 — ★ Actual size of data in memory (before padding)
    } Misc;
    DWORD VirtualAddress;         // 0x0C — ★ RVA in memory where section starts
    DWORD SizeOfRawData;          // 0x10 — ★ Size on disk (aligned to FileAlignment)
    DWORD PointerToRawData;       // 0x14 — ★ File offset of section data on disk
    DWORD PointerToRelocations;   // 0x18 — Offset to COFF relocs (object files only)
    DWORD PointerToLinenumbers;   // 0x1C — Obsolete
    WORD  NumberOfRelocations;    // 0x20
    WORD  NumberOfLinenumbers;    // 0x22
    DWORD Characteristics;        // 0x24 — ★ Section flags (read/write/exec/etc.)
} IMAGE_SECTION_HEADER;

# Enumerate all sections
for section in pe.sections:
    print(f"  Name:     {section.Name.decode().strip(chr(0))}")
    print(f"  VirtAddr: {section.VirtualAddress:#010x}")
    print(f"  VirtSize: {section.Misc_VirtualSize:#010x}")
    print(f"  RawSize:  {section.SizeOfRawData:#010x}")
    print(f"  RawPtr:   {section.PointerToRawData:#010x}")
    print(f"  Flags:    {section.Characteristics:#010x}")
    print()

┌──────────────────────────────────────────────────────────────────────┐
│ IDT — Import Descriptor Table                                        │
│                                                                      │
│ • One IMAGE_IMPORT_DESCRIPTOR per imported DLL                       │
├──────────────────────────────────────────────────────────────────────┤
│ ILT — Import Lookup Table (a.k.a. INT)                               │
│                                                                      │
│ • List of imported function names or ordinals                        │
├──────────────────────────────────────────────────────────────────────┤
│ IAT — Import Address Table                                           │
│                                                                      │
│ • Patched by the Windows loader with real function addresses         │
│ • Executable code calls imported functions through this table        │
└──────────────────────────────────────────────────────────────────────┘

typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    union {
        DWORD Characteristics;
        DWORD OriginalFirstThunk;  // 0x00 — RVA to ILT (Import Lookup Table)
    };
    DWORD TimeDateStamp;           // 0x04 — 0 if not bound, -1 if all bound
    DWORD ForwarderChain;          // 0x08 — Chained forwarding (-1 if none)
    DWORD Name;                    // 0x0C — RVA to DLL name string
    DWORD FirstThunk;              // 0x10 — RVA to IAT (patched by loader)
} IMAGE_IMPORT_DESCRIPTOR;
// Terminated by a null entry (all zeros)

# Enumerate imports
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    print(f"\n  DLL: {entry.dll.decode()}")
    for imp in entry.imports:
        if imp.name:
            print(f"    [{imp.address:#010x}]  {imp.name.decode()}  (hint={imp.hint})")
        else:
            print(f"    [{imp.address:#010x}]  Ordinal #{imp.ordinal}")

typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD Characteristics;      // 0x00 — Reserved, 0
    DWORD TimeDateStamp;        // 0x04 — Timestamp
    WORD  MajorVersion;         // 0x08
    WORD  MinorVersion;         // 0x0A
    DWORD Name;                 // 0x0C — RVA to DLL name string
    DWORD Base;                 // 0x10 — Starting ordinal number (usually 1)
    DWORD NumberOfFunctions;    // 0x14 — Total number of exported functions
    DWORD NumberOfNames;        // 0x18 — Number of named exports
    DWORD AddressOfFunctions;   // 0x1C — RVA to Export Address Table (EAT)
    DWORD AddressOfNames;       // 0x20 — RVA to array of name RVAs
    DWORD AddressOfNameOrdinals;// 0x24 — RVA to ordinal table (maps names→ordinals)
} IMAGE_EXPORT_DIRECTORY;

# Enumerate exports
if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
    for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
        name = exp.name.decode() if exp.name else f"Ordinal #{exp.ordinal}"
        print(f"  [{exp.address:#010x}]  Ordinal={exp.ordinal}  Name={name}")

typedef struct _IMAGE_BASE_RELOCATION {
    DWORD VirtualAddress; // RVA of the 4 KB page this block covers
    DWORD SizeOfBlock;    // Total size of this block (including header)
    // Followed by (SizeOfBlock - 8) / 2 entries:
    WORD  TypeOffset[];   // High 4 bits = type, Low 12 bits = offset within page
} IMAGE_BASE_RELOCATION;

# Enumerate relocations
if hasattr(pe, 'DIRECTORY_ENTRY_BASERELOC'):
    for base_reloc in pe.DIRECTORY_ENTRY_BASERELOC:
        print(f"  Block RVA: {base_reloc.struct.VirtualAddress:#010x}")
        for entry in base_reloc.entries:
            print(f"    Type={entry.type}  Offset={entry.rva:#010x}")

# Enumerate relocations
if hasattr(pe, 'DIRECTORY_ENTRY_BASERELOC'):
    for base_reloc in pe.DIRECTORY_ENTRY_BASERELOC:
        print(f"  Block RVA: {base_reloc.struct.VirtualAddress:#010x}")
        for entry in base_reloc.entries:
            print(f"    Type={entry.type}  Offset={entry.rva:#010x}")

typedef struct _IMAGE_TLS_DIRECTORY32 {
    DWORD StartAddressOfRawData; // VA of TLS data start
    DWORD EndAddressOfRawData;   // VA of TLS data end
    DWORD AddressOfIndex;        // VA of TLS index slot
    DWORD AddressOfCallBacks;    // ★ VA of array of TLS callback function VAs
    DWORD SizeOfZeroFill;
    DWORD Characteristics;
} IMAGE_TLS_DIRECTORY32;

# Check for TLS callbacks
if hasattr(pe, 'DIRECTORY_ENTRY_TLS'):
    tls = pe.DIRECTORY_ENTRY_TLS
    print(f"  TLS Directory at: {tls.struct.AddressOfCallBacks:#010x}")
    # TLS callbacks are VAs, not RVAs!

# Enumerate resources
if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):
    for res_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:
        type_name = str(res_type.id) if not res_type.name else res_type.name.string.decode()
        print(f"\n  Type: {type_name}")
        for res_id in res_type.directory.entries:
            for res_lang in res_id.directory.entries:
                data = pe.get_data(
                    res_lang.data.struct.OffsetToData,
                    res_lang.data.struct.Size
                )
                print(f"    ID={res_id.id}  Lang={res_lang.id}  Size={len(data):#x}")

if hasattr(pe, 'VS_VERSIONINFO'):
    if hasattr(pe, 'FileInfo'):
        for fi in pe.FileInfo:
            for entry in fi:
                if hasattr(entry, 'StringTable'):
                    for st in entry.StringTable:
                        for k, v in st.entries.items():
                            print(f"  {k.decode()}: {v.decode()}")

# RVA → file offset
def rva_to_offset(pe, rva):
    for section in pe.sections:
        if section.VirtualAddress <= rva < section.VirtualAddress + section.Misc_VirtualSize:
            return section.PointerToRawData + (rva - section.VirtualAddress)
    return None

# File offset → RVA
def offset_to_rva(pe, offset):
    for section in pe.sections:
        if section.PointerToRawData <= offset < section.PointerToRawData + section.SizeOfRawData:
            return section.VirtualAddress + (offset - section.PointerToRawData)
    return None

# VA → file offset (assumes default ImageBase)
def va_to_offset(pe, va):
    rva = va - pe.OPTIONAL_HEADER.ImageBase
    return rva_to_offset(pe, rva)

# pefile built-in helpers
offset = pe.get_offset_from_rva(0x1000)
rva    = pe.get_rva_from_offset(0x400)
data   = pe.get_data(rva=0x1000, length=64)

# ── pefile (Python) — gold standard for scripting ──
pip install pefile
python3 -c "import pefile; pe=pefile.PE('sample.exe'); print(pe.dump_info())"

# ── PE-bear — free GUI PE viewer ──
# https://github.com/hasherezade/pe-bear
# Shows: all headers, sections, imports, exports, rich header, hex view

# ── CFF Explorer — Windows GUI ──
# https://ntcore.com/cff-explorer/
# Excellent for manual struct inspection

# ── pestudio — malware-first PE viewer ──
# https://www.winitor.com/
# Flags suspicious imports, entropy, blacklisted strings, VirusTotal

# ── DIE — Detect It Easy — packer / compiler fingerprinting ──
# https://github.com/horsicq/Detect-It-Easy
die sample.exe

# ── exiftool — metadata extraction ──
exiftool sample.exe
# Shows: compile time, linker version, subsystem, original filename, version info

# ── strings — extract printable strings ──
strings -n 6 sample.exe | grep -i "http\|cmd\|powershell\|C:\\"
strings -e l sample.exe   # Unicode strings

# ── readpe (libpe tools) ──
readpe --headers sample.exe
readpe --imports sample.exe
readpe --exports sample.exe
readpe --sections sample.exe

# High entropy (> 7.0) in a section = packed / encrypted / compressed content
# Normal .text = 5.5–6.5
# Normal .rdata = 4.0–5.5
# Packed binary .text = 7.8–8.0

# Python entropy calculation
import math
def entropy(data):
    if not data: return 0
    counts = [data.count(bytes([i])) for i in range(256)]
    total = len(data)
    return -sum((c/total) * math.log2(c/total) for c in counts if c)

import pefile
pe = pefile.PE("sample.exe")
for section in pe.sections:
    data = section.get_data()
    e = entropy(data)
    name = section.Name.decode().strip('\x00')
    print(f"  {name:<10} entropy={e:.2f}  size={len(data):#x}")

# ── x64dbg / x32dbg — best free Windows debugger ──
# PE-aware, symbol support, scripting, plugin ecosystem

# ── WinDbg — Microsoft debugger ──
windbg -o sample.exe

# ── Process Hacker / System Informer ──
# Inspect loaded PE modules, memory regions, loaded sections in real-time

# ── Ghidra — free NSA decompiler / disassembler ──
# Full PE support, import/export/xrefs, decompiler output

# ── IDA Pro / IDA Free ──
# Industry standard disassembler / decompiler

import pefile, math

pe = pefile.PE("sample.exe")

# ── Architecture ──
arch = "x64" if pe.OPTIONAL_HEADER.Magic == 0x20b else "x86"
print(f"Arch: {arch}")

# ── Compile timestamp ──
import datetime
ts = datetime.datetime.utcfromtimestamp(pe.FILE_HEADER.TimeDateStamp)
print(f"Compiled: {ts} UTC")

# ── OEP ──
oep = pe.OPTIONAL_HEADER.AddressOfEntryPoint
print(f"OEP RVA: {oep:#010x}  VA: {pe.OPTIONAL_HEADER.ImageBase + oep:#010x}")

# ── Is DLL? ──
is_dll = pe.FILE_HEADER.Characteristics & 0x2000
print(f"Is DLL: {bool(is_dll)}")

# ── Has ASLR? ──
aslr = pe.OPTIONAL_HEADER.DllCharacteristics & 0x0040
print(f"ASLR: {bool(aslr)}")

# ── Has NX/DEP? ──
nx = pe.OPTIONAL_HEADER.DllCharacteristics & 0x0100
print(f"NX/DEP: {bool(nx)}")

# ── Has CFG? ──
cfg = pe.OPTIONAL_HEADER.DllCharacteristics & 0x4000
print(f"CFG: {bool(cfg)}")

# ── All imports as flat list ──
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
    for dll in pe.DIRECTORY_ENTRY_IMPORT:
        for fn in dll.imports:
            name = fn.name.decode() if fn.name else f"ord#{fn.ordinal}"
            print(f"  {dll.dll.decode()}!{name}")

# ── Dump all strings ──
import re
raw = pe.__data__
ascii_strs = re.findall(b'[\x20-\x7e]{4,}', raw)
for s in ascii_strs[:50]:
    print(s.decode())

strings -n 4 sample.exe | grep -Ei \
    "cmd\.exe|powershell|wscript|cscript|\
    http://|https://|/update|/gate|/check|\
    TEMP\\|APPDATA\\|System32\\\
    schtasks|reg add|net user|net localgroup|\
    CreateRemoteThread|VirtualAlloc|LoadLibrary|\
    base64|mimikatz|sekurlsa|lsass"

Got a PE sample?
│
├── Unknown packer / compiler?
│ └── DIE (Detect It Easy) → identifies packer, compiler, overlay
│
├── Quick static overview?
│ └── pestudio → headers, imports, strings, entropy, VirusTotal
│
├── Manual struct inspection (GUI)?
│ └── PE-bear or CFF Explorer
│
├── Script / automate analysis?
│ └── pefile in Python
│
├── Disassemble / decompile?
│ └── Ghidra (free) or IDA Pro
│
├── Dynamic analysis / debugging?
│ └── x64dbg + ScyllaHide plugin (anti-anti-debug)
│
├── Detect high-entropy packed sections?
│ └── pefile entropy calculation or pestudio
│
├── Hunt suspicious imports?
│ └── pestudio flagging + manual review of injection-related APIs
│
└── Check for TLS callbacks (pre-OEP execution)?
└── pefile DIRECTORY_ENTRY_TLS + x64dbg TLS breakpoints