Portable Executable

Portable Executable
Name	Portable Executable
Developer	Microsoft
Released	1993
Latest release	Windows NT 4.0 era expansions
Operating system	Microsoft Windows, ReactOS, Wine
File extension	.exe, .dll, .sys, .ocx
Genre	Executable file format

Portable Executable

The Portable Executable format is a Microsoft file format introduced for Windows NT that encapsulates executable code, data, and metadata for native binaries used by Microsoft operating systems and compatible projects like ReactOS and Wine. It evolved from the COFF object file model and interacts closely with components such as the Windows API, the NT kernel, and loaders used by Microsoft Visual C++, GCC, and other toolchains. PE files underpin system tools, device drivers, and application binaries across desktop, server, and embedded editions including Windows 10, Windows Server 2019, Xbox One, and legacy platforms like Windows 95 and Windows NT 3.51.

Overview

The format derives from the Common Object File Format used by compilers like Microsoft Visual C++, Borland C++, and GNU Compiler Collection, and it supports execution models compatible with Intel 80386, AMD64/x86-64, and ARM architectures used in systems such as Surface Pro, Dell XPS, HP Pavilion, and Raspberry Pi variants running Windows IoT. PE files are central to development workflows involving Visual Studio, CMake, LLVM, and deployment tools like Inno Setup and WiX Toolset. The design enables dynamic linking implemented by components such as the Windows Loader, the Dynamic Link Library mechanism popularized by IBM and Microsoft, and runtime infrastructures like the .NET Framework and Windows Runtime.

File Format Structure

A PE file begins with a legacy header historically tied to executables from MS-DOS era tools like Microsoft QuickBasic and contains a signature that points to the modern header used by loaders in Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, and later. The structure includes sections similar to those in ELF used on Linux distributions like Ubuntu, Debian, Red Hat Enterprise Linux, and Fedora, and shows conceptual parallels with formats used on macOS such as Mach-O employed by Apple platforms like MacBook Pro, iMac, and iPhone (via cross-compilation). Tooling for inspecting PE structures includes utilities from Sysinternals, GNU binutils, ReadElf analogs, PE Explorer, and debuggers like WinDbg, GDB, OllyDbg, and IDA Pro.

Header and Data Directories

Key elements include the DOS header compatible with MS-DOS programs, the PE signature adopted during the transition to Windows NT, and the COFF File Header used by linkers such as Microsoft Linker (link.exe), GNU ld, and Gold linker. The Optional Header contains entry point addresses and image base preferences relevant to system components like the Windows Boot Manager, Ntldr, and the Windows Subsystem for Linux loader. Data directories enumerate structures used by subsystems such as the Import Address Table consumed by the Loader, the Export Table used by Kernel32.dll and User32.dll, the Resource Table accessed by Explorer.exe, and the Load Config Directory consulted by Windows Defender and SecEdit policies. Debug information formats produced by compilers and debuggers like PDB files are referenced in debug directories handled by tools like Visual Studio Debugger and WinDbg Preview.

Sections and Sections Table

The section table lists named sections such as .text, .rdata, .data, and .rsrc that are analogous to segments in ELF binaries used on CentOS, OpenSUSE, and Arch Linux. Sections carry executable code for processes like Explorer.exe, read-only data used by Notepad.exe, initialized data for svchost.exe services, and resources for GUI elements referenced by Control Panel applets and Microsoft Office components like Word and Excel. Linkers from Microsoft Visual C++, Clang, and MinGW populate these sections and set alignment constraints enforced by the NT kernel loader and firmware components such as BIOS and UEFI that influence memory mapping on hardware from Intel Corporation, AMD, NVIDIA, and ARM Holdings licensees.

Import/Export and Dynamic Linking

PE supports dynamic linking via import and export tables enabling shared libraries exemplified by Kernel32.dll, User32.dll, Gdi32.dll, Advapi32.dll, and third-party libraries from vendors like Adobe Systems, Oracle Corporation, Mozilla Foundation, and Google. The Import Address Table enables runtime binding carried out by the loader and influenced by policies from AppLocker, Software Restriction Policies, and Windows Defender Application Control. Export tables allow applications and drivers such as ntoskrnl.exe, atioglxx.dll, and nvd3dum.dll to expose symbols consumed by other modules; debuggers and binary analysis tools like Procmon and Process Explorer enumerate these relationships. Techniques such as delayed loading, import thunking, and runtime linking interact with languages and runtimes including C#, Visual Basic, Delphi, and Rust when targeting Windows.

Relocations and Addressing

Relocation tables enable rebasing when preferred image bases collide, a concern for system components like lsass.exe, svchost.exe, and wininit.exe loaded at runtime across architectures including x86-64 and ARM64. Address space layout randomization (ASLR) introduced in Windows Vista and enhanced in Windows 10 interacts with relocation information and mitigations such as DEP and Control Flow Guard used to harden binaries compiled by Microsoft Visual C++, GCC, Clang, and Intel Compiler. Kernel-mode drivers signed for Windows 10 and distributed through Windows Update must manage relocations alongside signature enforcement by Secure Boot and policies enforced by Trusted Platform Module deployments in enterprise environments such as Azure and Microsoft Intune managed fleets.

Variants and Platform Extensions

PE variants include the common PE32 and PE32+ formats for 32-bit and 64-bit images used by Windows XP, Windows 7, Windows 8.1, Windows 11, and server editions; executable variants for device drivers (.sys) and COM servers (.dll/.ocx) appear across applications from Siemens, Siemens Healthineers, GE Healthcare, and Philips in regulated settings. Extensions and related formats appear in projects like Portable Executable and Common Object File Format (PE/COFF) for UEFI firmware images, in .NET Assembly metadata layered atop PE for CLR runtimes, and in compatibility layers such as Wine and ReactOS that implement loader behavior for applications from Microsoft Office, Adobe Photoshop, AutoCAD, Steam, and Valve Corporation titles. Tools and initiatives for analysis and transformation include CFF Explorer, PEiD, Binary Ninja, Radare2, and community efforts hosted by organizations like GitHub, OpenBSD ports, and Apache Software Foundation projects.

Category:Executable file formats