Parse a Windows PE Executable Header

PE Format: Windows Executables

The Portable Executable (PE) format is used for .exe, .dll, and driver files on Windows. If you analyze cross-platform malware or compare Linux ELF with Windows binaries, you need to understand this layout.

PE Structure

A PE file layers several headers:

1. DOS Header (64 bytes): Legacy stub with e_magic = 'MZ' (0x5A4D)
2. PE Signature: 'PE\0\0' at offset given by e_lfanew
3. COFF Header: Machine type, section count, timestamp
4. Optional Header: Entry point, image base, subsystem
5. Section Headers: Names, virtual addresses, raw data pointers

For example, a 64-bit Windows executable has COFF Machine = 0x8664 and optional header Magic = 0x20B (PE32+).

For This Exercise

You will parse DOS and PE headers, verify both magic values, and print machine type, entry point, and section information. Comparing PE with ELF helps you see that both formats solve the same problem (describing loadable code and data) with different field layouts.

PE vs ELF Loading

Windows maps PE sections using VirtualAddress and SizeOfRawData, while ELF uses program headers for loading and section headers for linking. The PE optional header Subsystem field tells you whether the binary expects a console (3) or GUI (2). Cross-platform malware analysts encounter both formats, so recognizing MZ versus ELF magic immediately routes you to the correct parser.