PE (file format)

PE (file format)
Name	PE
Extension	.exe, .dll, .ocx, .sys
Mime	application/vnd.microsoft.portable-executable
Developer	Microsoft
Released	1993
Type	Executable, object code, DLL

PE (file format)

The PE format is the native executable file format used on Microsoft Windows and related Microsoft Windows NT-based systems including Windows 10, Windows Server 2019, Xbox One, and the Windows CE family. It evolved from formats used in MS-DOS and OS/2 and interacts with subsystems such as the Windows API, NT Kernel, and the Portable Executable Specification maintained by Microsoft engineers and contributors from companies like Intel and AMD. Implementations of PE are integral to toolchains including Microsoft Visual Studio, GCC, MinGW, and linker technologies used by projects such as Wine and ReactOS.

Overview

The PE container encapsulates code, data, resources, and metadata so loaders such as the Windows Loader and runtime components like ntoskrnl.exe can map images into address spaces for processes like explorer.exe or svchost.exe. PE derives structural concepts from the COFF object file format and shares lineage with executables targeted by compilers from Borland and Intel C Compiler. The format supports 32-bit and 64-bit variants used on x86, x86-64, and other architectures supported by Windows on ARM and vendor ecosystems including Qualcomm and NVIDIA.

File structure

A PE file begins with an MS-DOS-compatible stub compatible with legacy bootstrapping used by utilities like MS-DOS COMMAND.COM and tools including IMAGEHLP. Following the stub is the PE signature and a COFF File Header with fields that reference optional headers and section tables familiar to developers using Linker (computing), Debugger (computing), or utilities such as Dumpbin and objdump. The Optional Header contains address and alignment info consumed by the loader and influenced by compilers from Microsoft Visual C++, Clang, and Intel toolchains. Resource data within PE is used by user interfaces like Explorer (Windows) and frameworks such as MFC and .NET Framework for icons, manifests, and version info.

Headers and directories

Key headers include the DOS MZ header, the PE signature, the COFF File Header, and the Optional Header used by the Image File Execution Options and loader subsystems. The Optional Header exposes Data Directories that point to tables such as the Import Address Table and Export Table leveraged by dynamic linking mechanisms employed by kernel32.dll, user32.dll, and runtime libraries like ucrtbase.dll. Other directories reference the Exception Table used by structured exception handling in Structured Exception Handling, the Certificate Table used by code signing chains verified by Authenticode, and debug data consumed by debuggers like WinDbg and Visual Studio Debugger.

Sections and alignment

Sections such as .text, .rdata, .data, and .rsrc host executable code, read-only data, writable data, and resources respectively and are declared in the Section Table akin to segment descriptors in x86 segment registers used by low-level tools like IDAPRO and Ghidra. Section alignment and file alignment fields in the Optional Header determine in-memory mapping behavior during load time and are honored by the Windows Memory Manager and address-space layout facilities used in Process Explorer and Task Manager. Compiler-generated sections like .pdata and .reloc interact with exception handling on x86-64 and relocation entries required when images are rebased for address space layout randomization used by ASLR.

Loading and execution

At execution, the Windows loader validates headers, maps sections into the process virtual address space, resolves imports via the Import Address Table and dynamic linkers such as LoadLibrary, applies base relocations from the .reloc section, and transfers control to the entry point function commonly implemented by runtime startups like CRT startup code and frameworks including .NET Common Language Runtime. The loader consults security policies enforced by components including Windows Defender and AppLocker and may interact with virtualization subsystems such as Hyper-V or compatibility shims used by Application Compatibility Toolkit.

Versioning and variants

PE has spawned variants including PE32 for 32-bit images and PE32+ for 64-bit images, plus platform-specific flavors for Windows CE and consoles like Xbox 360 and Xbox Series X. Container formats and extensions such as .NET Assembly metadata (managed code using Common Intermediate Language) embed CLR headers inside PE, while boot executables and drivers use specialized conventions consumed by WinPE and NT Kernel subsystems. Toolchains from GNU Compiler Collection, LLVM, and proprietary vendors implement cross-compilation and produce variant PE images for ecosystems such as Azure and embedded partners like Texas Instruments.

Security and parsing issues

Parsing PE correctly is critical for antivirus solutions like Symantec, Kaspersky, McAfee, and static analysis tools including VirusTotal and YARA rulesets; malformed or deliberately crafted headers can trigger vulnerabilities exploited by incident actors linked to campaigns investigated by CERT teams, Microsoft Security Response Center, and law enforcement partnerships. Attack techniques include import table manipulation, export name spoofing, malformed relocation entries, and packing/encryption used by families tracked by MITRE ATT&CK and threat groups profiled by vendors like CrowdStrike and Mandiant. Robust parsers used by debuggers such as WinDbg, reverse-engineering suites like Radare2, and sandbox platforms such as Cuckoo Sandbox implement strict validation against the specification to mitigate parsing ambiguity and potential denial-of-service or code-execution vulnerabilities.

Category:Executable file formats