In these cases, the non-forwarded imports can be bound, but the values which get forwarded must be identified so the loader can resolve them. These values have little or no impact on the actual exports themselves. This precompiled code can be inserted into the final executable to implement a function, saving the programmer a lot of time. The PE portable executable file format includes a number of informational headers, and is arranged in the following format:. An entry point is optional for DLLs. These point at yet another resource directory, which uses ID numbers to distinguish languages, allowing different specific resources for systems using a different language.

Uploader: Kagalkis
Date Added: 10 June 2018
File Size: 32.40 Mb
Operating Systems: Windows NT/2000/XP/2003/2003/7/8/10 MacOS 10/X
Downloads: 88822
Price: Free* [*Free Regsitration Required]

This field points to a location where the program expects to receive the TLS index. This is valid only for object files.

This file offset is placed at location 0x3c during linking. Therefore, everything in object files with section name. The valid exception handlers of an object are listed in the.

This checksum includes the entire file including any attribute certificates in the file. By using our site, you acknowledge that you have read and understand our Cookie PolicyPrivacy Policyand our Terms of Service. Instead, each module library or executable must declare what functions or values it exports to other modules, and also what it wishes to import from other modules. The high 16 bits of jmage target’s bit VA.



The size of the local heap space to reserve. This flag is deprecated for Windows and later and must be zero. BaseOfData A pointer to the beginning of the data section, relative to the image base. If the string wxm exactly 8 characters long, there is no terminating null. This relocation must be immediately followed by a PAIR relocation whose SymbolTableIndex contains a signed bit displacement that is added to the upper 16 bits that was taken from the location that is being relocated.

A reference to the 8-bit instruction whose low 4 bits contain the effective bit VA of the target symbol.


The number of sections. This field enables support of sdm debuggers. The areas of the PE image that are related to the Authenticode signature are not included in the calculation of the PE image hash because Authenticode signatures can be added to or removed from an image without affecting the overall integrity of the image. The supplied delay-load helper uses this location to store the handle to the loaded DLL.

The file pointer to the beginning of line-number entries for the section. This is done through the use of the “Export Directory”, which is used to translate between the name of an export or “Ordinal”, see belowand a location in memory where the code or data can be found.

Note that this address is not an RVA; it is an address for which there should be a base relocation in the. The starting address of the TLS template. In fact, this is sometimes done as a disk-saving measure. Other compilers that support TLS and work with the Microsoft linker must use this same technique.


The default is the page size for the architecture. The linker removes a. The alignment factor in bytes that is used to align the raw data of sections in the image file. A reference to a bit location that is the VA of the section that contains the target symbol. This address is relative to the image base.

Suppose we are analyzing a bit executable that has a Characteristics value of 0x The template is a block of data that is used to initialize TLS data.

The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. For object files, this field is the address of the first byte before relocation is applied; for simplicity, compilers should set this to zero.

When a bit Windows file is run in a bit DOS environment, the program will display the error message: For device drivers, this is the address of the initialization function.