Saturday, 19 March 2016

Portable Executable - PE

The Portable Executable (PE) format is a file format for executables, object code, DLLs and other used in 32/64 bit versions of Windows OS.

A PE file contains the following sections:

  1. .text - contains the executable code
  2. .rdata - hold read-only data that is globally accessible within the program
  3. .data - stores global data access throughout the program
  4. .idata - sometimes present and stores the import function information
  5. .edata - sometimes present and stores the export function information
  6. .pdata - only in 64 bit executables and stores exceptional handling information
  7. .rsrc - stores resources needed by the executables
  8. .reloc - contains information for relocation of library files





Tools used to examine PE files:

  1. PEview 


Source: Practical Malware Analysis, hackerzvoice