Data Fields | |
| uint8_t | MajorLinkerVersion |
| uint8_t | MinorLinkerVersion |
| uint32_t | SizeOfCode |
| uint32_t | SizeOfInitializedData |
| uint32_t | SizeOfUninitializedData |
| uint64_t | ImageBase |
| uint32_t | SectionAlignment |
| uint32_t | FileAlignment |
| uint16_t | MajorOperatingSystemVersion |
| uint16_t | MinorOperatingSystemVersion |
| uint16_t | MajorImageVersion |
| uint16_t | MinorImageVersion |
| uint32_t | CheckSum |
| uint32_t | NumberOfRvaAndSizes |
PE 64-bit optional header
| uint32_t CheckSum |
NT drivers only
| uint32_t FileAlignment |
usually 32 or 512
| uint64_t ImageBase |
multiple of 64 KB
| uint16_t MajorImageVersion |
unreliable
| uint8_t MajorLinkerVersion |
unreliable
| uint16_t MajorOperatingSystemVersion |
not used
| uint16_t MinorImageVersion |
unreliable
| uint8_t MinorLinkerVersion |
unreliable
| uint16_t MinorOperatingSystemVersion |
not used
| uint32_t NumberOfRvaAndSizes |
unreliable
| uint32_t SectionAlignment |
usually 32 or 4096
| uint32_t SizeOfCode |
unreliable
| uint32_t SizeOfInitializedData |
unreliable
| uint32_t SizeOfUninitializedData |
unreliable