Search code examples
executableportable-executable

Why are there so many conflicting sources on the anatomy of Windows PE files?


I was trying to do research on the Windows PE executable format, and every source I can find tells a different story about what sections are in a PE file. No two sources say the same thing. They all conflict. I finally had to go to the Microsoft website, because I think that would be the only reliable source at this point. Are there different versions of Windows PE or something? What is the reason for this discrepancy?


Solution

  • There are no 'conflicting' articles about what sections there are in a PE file. There may be a few but there most likely just plain wrong. In PE files the sections can come in different order, different names on different operating systems, etc. The whole structure of the PE file can changed just based on how the programmer programs it. The main reason that things appear so different is because there's no fixed format. Of course there are the same keywords such as PE but these can be in completely different places.

    I recommend you look at PE101, it's a website that explains the PE format in great detail:

    https://code.google.com/p/corkami/wiki/PE101

    Also, please remove the windows-pe tag from your question. It refers to Windows PE the operating system, not the PE file format.