Windows PE格式说明V8 Microsoft Portable Executable and Common Objec...

Microsoft Portable Executable and

Common Object File Format

Specification

Revision 8.1 – February 15, 2008

Abstract

This specification describes the structure of executable (image) files and object

files under the Windows® family of operating systems. These files are referred to

as Portable Executable (PE) and Common Object File Format (COFF) files,

This information applies for the following operating systems:

Windows Server® 2008

Windows Vista®

Windows Server 2003

Windows XP

Windows 2000

References and resources discussed here are listed at the end of this paper.

For the latest information, see:

http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx

Microsoft Portable Executable and Common Object File Format Specification - 2

Revision 8.1

Note: This specification is provided to aid in the development of certain development tools for the

Microsoft Windows platform. However, Microsoft does not guarantee that it is a complete specification in

all respects, and cannot guarantee the accuracy of any information presented after the date of

publication. Microsoft reserves the right to alter this specification without notice.

Microsoft will grant a royalty-free license, under reasonable and non-discriminatory terms and conditions,

to any Microsoft patent claims (if any exist) that Microsoft deems necessary for the limited purpose of

implementing and complying with the required portions of this specification only in the software

permission of Microsoft.

Microsoft may have intellectual property rights covering subject matter in this specification. Except as

expressly provided in any written license agreement from Microsoft, the furnishing of this specification

does not give you any license to any intellectual property rights, and no other rights are granted by

implication, estoppel, or otherwise.

© 2005–2008 Microsoft Corporation. All rights reserved.

This specification is provided “AS IS.” Microsoft makes no representations or warranties,

Microsoft Portable Executable and Common Object File Format Specification - 3

Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United

trademarks of their respective owners.

The foregoing names and trademarks may not be used in any manner, including advertising or publicity

pertaining to this specification or its contents without specific, written prior permission from the respective

owners.

Microsoft Portable Executable and Common Object File Format Specification - 4

3.2. Signature (Image Only) ................................................................................... 1

3.3. COFF File Header (Object and Image) ............................................................ 1

3.3.1. Machine Types ........................................................................................ 1

3.3.2. Characteristics ........................................................................................ 1

3.4. Optional Header (Image Only) ....................................................................... 1

3.4.1. Optional Header Standard Fields (Image Only) ...................................... 1

3.4.2. Optional Header Windows-Specific Fields (Image Only) ........................ 1

3.4.3. Optional Header Data Directories (Image Only) ..................................... 1

4. Section Table (Section Headers) ............................................................................ 1

4.1. Section Flags ................................................................................................... 1

5.4. COFF Symbol Table ......................................................................................... 1

5.4.1. Symbol Name Representation ................................................................ 1

5.4.2. Section Number Values........................................................................... 1

5.4.3. Type Representation ............................................................................... 1

5.4.4. Storage Class ........................................................................................... 1

5.5. Auxiliary Symbol Records ............................................................................... 1

5.5.1. Auxiliary Format 1: Function Definitions ................................................ 1

5.5.2. Auxiliary Format 2: .bf and .ef Symbols .................................................. 1

5.5.3. Auxiliary Format 3: Weak Externals ........................................................ 1

5.5.4. Auxiliary Format 4: Files.......................................................................... 1

Microsoft Portable Executable and Common Object File Format Specification - 5

5.8. Delay-Load Import Tables (Image Only) ......................................................... 1

5.8.1. The Delay-Load Directory Table .............................................................. 1

5.8.2. Attributes ................................................................................................ 1

5.8.3. Name ....................................................................................................... 1

5.8.4. Module Handle ....................................................................................... 1

5.8.5. Delay Import Address Table .................................................................... 1

5.8.6. Delay Import Name Table ....................................................................... 1

5.8.7. Delay Bound Import Address Table and Time Stamp ............................. 1

5.8.8. Delay Unload Import Address Table ....................................................... 1

6. Special Sections ..................................................................................................... 1

6.1. The .debug Section ......................................................................................... 1

6.1.7. Linker Support for Microsoft Debug Information ................................... 1

6.2. The .drectve Section (Object Only) ................................................................ 1

6.3. The .edata Section (Image Only) .................................................................... 1

6.3.1. Export Directory Table ............................................................................ 1

6.3.2. Export Address Table .............................................................................. 1

6.3.3. Export Name Pointer Table ..................................................................... 1

6.3.4. Export Ordinal Table ............................................................................... 1

6.3.5. Export Name Table ................................................................................. 1

6.4. The .idata Section ........................................................................................... 1

6.4.1. Import Directory Table ........................................................................... 1

6.6.2. Base Relocation Types ............................................................................ 1

6.7. The .tls Section ............................................................................................... 1