Malleum Knowledge Base

PE Intro

3 min read

Expanded PE File Structure for a Rust “Hello, World!” Program

1. DOS Header

  • Purpose: Provides compatibility with MS-DOS. Every PE file starts with a DOS header.
  • Key Fields:
    • e_magic: The magic number containing “MZ” (4D 5A), identifying the file as an executable.
    • e_lfanew: Offset to the PE header, which follows the DOS stub.

2. DOS Stub

  • Purpose: A stub program that runs when the executable is launched in a non-Windows environment, typically outputs “This program cannot be run in DOS mode.”
  • Contents: A small program (just a print operation), it’s largely historical but necessary for the file structure.

3. PE Header

  • Signature: Directly follows the DOS stub, marked by PE\0\0 to indicate the beginning of the actual PE header.

4. COFF Header

  • Purpose: Provides metadata about the PE file, crucial for the loader.
  • Key Fields:
    • Machine: Specifies the target architecture (e.g., x86, x64).
    • NumberOfSections: The number of sections in the file.
    • TimeDateStamp: Compilation timestamp.
    • PointerToSymbolTable and NumberOfSymbols: Used for debugging; often zero in executables.
    • SizeOfOptionalHeader: Indicates the size of the optional header.
    • Characteristics: Flags that indicate the attributes of the file (e.g., executable, large address aware).

5. Optional Header

  • Purpose: Contains additional parameters necessary for the loader.
  • Key Fields:
    • AddressOfEntryPoint: Memory address of the entry point function once the file is loaded into memory.
    • ImageBase: Preferred address of the first byte of the image when loaded into memory.
    • SectionAlignment: Alignment of sections when loaded into memory.
    • FileAlignment: Alignment of the raw data of sections in the file.
    • OperatingSystemVersion: Minimum required OS version.
    • ImageSize: Total size of the image in memory.
    • HeadersSize: Combined size of all headers.
    • Subsystem: The subsystem that is required to run this image (e.g., Windows GUI, Windows CUI).

6. Section Table

  • Purpose: Lists all sections in the file.
  • Sections:
    • .text: Contains the executable code.
    • .data: Contains initialized data.
    • .rsrc: Resource section; stores icons, menus, and other resources.
    • Additional Sections (e.g., .bss, .reloc): Depending on the program requirements.

7. Sections

  • .text Section: Contains the compiled Rust code that outputs “Hello, World!”.
  • .data Section: Holds any global or static variables that are initialized.
  • .rsrc Section: Includes resources like icons or images, if any.

Hypothetical Example of “Hello, World!” in Rust as a PE File

|---------------------------|
|       DOS Header          |
| - e_magic: 'MZ'           |
| - e_lfanew: [offset]      |
|---------------------------|
|       DOS Stub            |
| - [stub code]             |
|---------------------------|
|       PE Header           |
| - Signature: 'PE\0\0'     |
|---------------------------|
|       COFF Header         |
| - Machine: x64            |
| - NumberOfSections: 3     |
| - TimeDateStamp: [time]   |
| - SizeOfOptionalHeader: 240|
| - Characteristics: 0x210E |
|---------------------------|
|       Optional Header     |
| - Entry Point: 0x1000     |
| - Image Base: 0x140000000 |
| - Section Alignment: 4096 |
| - File Alignment: 512     |
| - OS Version: 6.0         |
| - Image Size: 0x2000      |
| - Headers Size: 0x400     |
| - Subsystem: Windows CUI  |
|---------------------------|
|       Section Table       |
| - .text: Code             |
| - .data: Variables        |
| - .rsrc: Resources        |
|---------------------------|
|       .text Section       |
| - 'Hello, World!' code    |
|---------------------------|
|
 
       .data Section       |
| - Initialized data        |
|---------------------------|
|       .rsrc Section       |
| - Icons/Images            |
|---------------------------|

This detailed breakdown provides a comprehensive look at each part of the PE file and how they interact to deliver a functioning executable on Windows platforms, specifically tailored to a simple Rust application.

Graph View