The Portable Executable and COFF File Format

A Comprehensive Technical Reference from Object Files to Windows Process Execution

Introduction: Why the PE Format Matters

Chapter 1: Origins of Executable Formats

1. Early Unix Executables and the a.out Lineage
2. The Rise of COFF at AT&T and Its Spread to IBM and DEC
3. Microsoft’s Adoption of COFF and the DOS/Windows Transition
4. From COFF to PE: Design Goals and Architectural Requirements
5. The PE Family Tree: Object Files, Images, DLLs and Drivers

Chapter 2: The Compilation and Linking Lifecycle

1. From Source to COFF Object: Assembly Generation and Object Creation
2. The COFF Object File Structure in Brief
3. Symbol Tables and String Tables in Object Files
4. Static Linking: Combining Objects into an Image
5. Section Merging, Relocation and Address Assignment
6. The Linker’s View of PE: What Gets Built and Why

Chapter 3: The DOS Header and Stub

1. The MZ Signature: History and Purpose
2. DOS Header Fields and Their Meanings
3. The DOS Stub: Compatibility Code and Execution
4. The e_lfanew Pointer: Bridging DOS and PE
5. DOS Header in Practice: Real Examples and Variations
6. Edge Cases: When the DOS Header is Absent or Minimal

Chapter 4: The COFF File Header

1. The PE Signature and COFF File Header Layout
2. Machine Type and Architecture Identification
3. Time Date Stamp, Symbol Table and Section Count
4. Characteristics Flags and Their Combinations
5. COFF File Header in Executables versus DLLs versus Drivers
6. Parsing the COFF File Header Safely in Code

Chapter 5: The Optional Header Overview

1. Why “Optional” and Why Mandatory for Images
2. Standard Fields: Magic, Linker Version and Code/Data Sizes
3. The Subsystem Field and Application Types
4. DllCharacteristics and Modern Security Flags
5. Address Layout: ImageBase, Entry Point and Image Size
6. Differences Between PE32 and PE32+ Optional Headers

Chapter 6: Section Headers and Section Layout

1. Section Header Structure and Required Fields
2. Section Names: Standard, Extended and Custom
3. Virtual Size versus Raw Size and the Meaning of Each
4. Virtual Address and Pointer to Raw Data
5. Section Characteristics: Code, Data, Read, Write, Execute, etc.
6. Alignment Constraints: File Alignment versus Section Alignment

Chapter 7: RVA to File Offset and Address Translation

1. Understanding RVA, VA and File Offset Distinctly
2. The Section Table as a Translation Map
3. RVA to File Offset: The Core Algorithm
4. File Offset to RVA: Reverse Translation and Ambiguities
5. VA to RVA in the Loaded Process Context
6. Edge Cases: Gaps, Overlaps and Malformed Sections

Chapter 8: The Data Directories

1. Data Directory Structure and Its Position in the Optional Header
2. The Export Table Directory
3. The Import Table Directory
4. The Resource Directory and Its Hierarchy
5. The Exception Directory and Unwind Information
6. The Certificate Table Directory
7. The Base Relocation Table Directory
8. The Debug Directory and Its Contents
9. The TLS Table Directory
10. The Load Configuration Table Directory
11. The Bound Import and IAT Directories
12. The Delay Import Descriptor Directory
13. The CLR Runtime Header Directory
14. The Remaining Directories

Chapter 9: Imports and Export Tables

1. The Export Directory Table: EAT Structure and Usage
2. Name Table, Ordinal Table and Address Table Interplay
3. The Import Descriptor and Its Fields
4. Import Lookup Table and Import Address Table
5. Bound Imports and Delay-Load Imports
6. Imports in DLLs versus EXEs versus Drivers

Chapter 10: Relocations and Base Relocation Tables

1. Object File Relocations versus Image Relocations
2. The Base Relocation Block Structure
3. Relocation Types: High, Low, HighLow and Architecture-Specific Variants
4. When and How Relocations Are Applied by the Loader
5. ASLR and the Relocation Table’s Role
6. Executables Without Relocations: When and Why This Happens

Chapter 11: Resources and the Resource Directory

1. Resource Directory Overview: Root, Name and Entry Levels
2. Resource Directory Entries and ID-Based versus Name-Based Resources
3. Common Resource Types and Their Data Formats
4. Icons, Dialogs, Menus and String Tables
5. Accessing Resources from Code
6. Resource Analysis for Malware and Anti-Forensics

Chapter 12: Debug Information and CodeView

1. The Debug Directory and Debug Directory Entry Structure
2. CodeView Format Identifiers: RSDS and NB10
3. PDB File References and Debug Information Storage
4. Other Debug Formats: CV, FPO and Misc
5. How Debuggers Locate and Load Debug Symbols
6. Stripped Binaries and Forensic Implications

Chapter 13: Exception Handling and Unwind Information

1. Exception Directory in PE32 versus PE32+
2. x86 Exception Handling: SEH and SEH Chains
3. x64 Unwind Information Structure and Unwind Codes
4. Guard Sections and CFG Exception Support
5. Exception Handling in Managed versus Native Code
6. Reading and Interpreting Exception Metadata

Chapter 14: Thread Local Storage

1. TLS Callbacks and Their Execution Order
2. TLS Directory Structure and Address Fields
3. TLS in DLLs versus Main Executables
4. TLS Initialization in the Loader
5. Practical TLS Usage Patterns
6. TLS in Malware and Evasion Techniques

Chapter 15: Load Configuration and Advanced Security

1. Load Configuration Directory Structure and Versioning
2. Control Flow Guard Metadata and Function Table
3. Security Cookie and Stack Buffer Overrun Protection
4. Dynamic Base, High Entropy ASLR and Terminal Server Awareness
5. Guard Flags and Load Time CFG

Chapter 16: Digital Signatures and Authenticode

1. The Certificate Table Data Directory
2. PKCS#7 and Authenticode Signature Structure
3. Signature Verification in the Windows Loader
4. Catalog Files and Driver Signing
5. Tampering Detection and Signature Stripping
6. Inspecting and Validating Signatures Programmatically

Chapter 17: Manifests and Side-by-Side Assemblies

1. The Role of Manifests in Versioning and Isolation
2. Embedded Manifests as RT_MANIFEST Resources
3. Manifest XML Structure and Key Elements
4. Side-by-Side Assembly Loading
5. Minimum Version Required and Activation Contexts
6. Manifests in Modern Windows and UWP

Chapter 18: CLR Headers and .NET Assemblies

1. PE as a Container for .NET Assemblies
2. The CLR Header Structure and Runtime Version
3. Metadata Directories and the Common Language Runtime
4. Native versus Managed versus Mixed-Mode Assemblies
5. Entry Point Differences: _CorExeMain versus Native Entry
6. Inspecting CLR Headers and .NET Metadata

Chapter 19: The Windows Loader: Image Loading Internals

1. The Loader’s View of a PE File
2. NtCreateSection and NtMapViewOfSection
3. Image Validation and Header Verification
4. Import Resolution and Dependency Loading
5. Base Relocation Application During Load
6. The Initialization Sequence: TLS, DllMain and Entry Point

Chapter 20: Loader Bookkeeping and Process Execution

1. The PEB and PEB_LDR_DATA
2. LDR_DATA_TABLE_ENTRY Structure and Module Links
3. Module Search Paths and DLL Search Order
4. Loading Drivers versus User-Mode Images
5. The Loader Lock and Synchronization
6. Observing Loader State with Debugging Tools

Chapter 21: Kernel-Mode PE: Drivers and the Kernel Loader

1. Driver PE Files: Format Differences and Requirements
2. Kernel-Mode vs User-Mode Loading Constraints
3. Driver Signing and Protected Process Light
4. Kernel-Mode Base Relocation and ASLR
5. Driver Entry Points and Initialization Routines
6. Kernel-Mode Debugging of PE-Loaded Drivers

Chapter 22: Building a PE Parser: Foundation and Core Structures

1. Project Design and Architecture
2. Safe Binary File Reading in C++
3. Parsing the DOS Header and Locating the PE Signature
4. Parsing the COFF File Header with Validation
5. Parsing the Optional Header for PE32 and PE32+
6. Parsing Section Headers and Building a Section Map

Chapter 23: Building a PE Parser: RVA Resolution and Data Directories

1. Implementing Safe RVA to File Offset Translation
2. Implementing File Offset to RVA Translation
3. Parsing and Validating Data Directories
4. Safe Bounds Checking and Integer Overflow Protection
5. Error Handling and Reporting for Malformed Binaries
6. Testing Against Real Executables

Chapter 24: Building a PE Parser: Imports, Exports and Relocations

1. Parsing Export Directories and Symbol Resolution
2. Parsing Import Descriptors and Building an Import Map
3. Handling Bound Imports and Delay-Load Imports
4. Parsing Base Relocation Blocks and Entry Types
5. Generating Human-Readable Import and Export Lists
6. Detecting Anomalies in Import and Export Tables

Chapter 25: Building a PE Parser: Resources, Debug and Security Features

1. Traversing the Resource Directory Hierarchy
2. Extracting and Categorizing Resource Data
3. Parsing Debug Directories and CodeView Information
4. Inspecting TLS Callbacks and Load Configuration
5. Validating Digital Signatures and Authenticode
6. Generating a Complete Analysis Report

Chapter 26: Security Implications and Adversarial Analysis

1. PE Parser Vulnerabilities and Implementation Pitfalls
2. Malformed and Crafted Binaries for Evasion
3. Overlapping Sections and Invalid Layouts
4. Packed Executables and Their Detection
5. File-Format Ambiguity and Polymorphic Techniques
6. Defensive Binary Inspection Best Practices

Chapter 27: Cross-Platform, Cross-Compiler and Evolutionary Perspectives

1. MSVC versus Clang/LLVM PE Generation Differences
2. Architecture-Specific Variations: x86, x64, ARM, ARM64
3. Cross-Compilation and Toolchain Interoperability
4. PE/COFF versus ELF: Structural and Philosophical Differences
5. Historical Evolution: Windows NT Through Windows 11
6. Future Directions and Format Extensions

Chapter 28: Conclusion

1. The PE/COFF Format as a Bridge Between Compilation and Execution
2. Key Architectural Insights and Design Patterns
3. What Makes a Robust PE Implementation
4. The Living Format: Ongoing Evolution
5. Further Reading and Investigation Paths

References