This article is rated C-class on Wikipedia's
content assessment scale. It is of interest to the following WikiProjects: | |||||||||||||||||||||||||||
|
PE does support position-independent code, it's just that no compiler or linker does. Interix executables compiled with GCC are position-independent PEs —Preceding unsigned comment added by 151.48.66.164 ( talk) 22:48, 21 November 2008 (UTC)
Much of this is inaccurate. The .NET CLR is NOT 'added after the PE/COFF headers' nor does the CLR itself contain the mscoree!_CorExeMain or mscoree!_CorDllMain reference. The CLR header, defined as IMAGE_COR20_HEADER, is referenced through a data directory (#14) in the PE/COFF header. This data directory points to the virtual address and size of the CLR header.
The normal PE/COFF IMPORT table contains the mscoree!_Cor*Main reference. The entry point has a single jmp far instruction into the IAT table entry for this single import.
The IMAGE_COR20_HEADER is used by the CLR when it is loaded into the process space through a .NET aware operating system (WindowsXP+) or through the mscoree!CorExeMain or mscoree!CoreDllMain APIs.
The "PE File Format Diagram" is broken, I don't know the right link... FYI Gil_mo 07:25, 15 July 2007 (UTC)
(and by extension 64-bit) Windows operating systems.
I didn't see any advantages of "yoda's LordPE Deluxe" and "PE Explorer" over "CFF Explorer" tool listed under "Related tools" section. The first one provides very limited set of features and the second one looks like advertisement. Hstab 02:52, 7 August 2007 (UTC)
Djamana ( talk) 03:51, 26 April 2009 (UTC)
This article is poorly written! anyone explain PE format more clearly? Visame ( talk) 18:42, 4 May 2008 (UTC)
What's the difference between Portable Executable and Universal Binary? If I've understood it right Portable Executable is single binary file which has built in binary code for several different architectures while Universal Binary is more like a container for different binaries for different architectures. Is that correct or are both the one and same thing? -- Dekonega ( talk) 13:23, 10 November 2009 (UTC)
32_64_universal
which compiles an application as 32 and 64-bit for both PowerPC and Intel (the resulting executable ending up with instructions for 4 architectures).
Dread Lord CyberSkull
✎☠ 09:33, 29 December 2011 (UTC)I've been reading up on the likelihood that the Xbox console used a somewhat-modified form of the Portable Executable format for its .xbe executable files. Can anyone substantiate this supposition? Did the format translate over the to the Xbox 360? If either answer is affirmative, should those pieces of information be included in the article?— WhosAsking ( talk) 18:40, 13 June 2010 (UTC)
Was PE specification open from the start or was it reverse-engineered and published post factum? 93.175.21.184 ( talk) 16:15, 13 January 2011 (UTC)
The Windows NT version 3.1 operating system introduces a new executable file format called the Portable Executable (PE) file format. The Portable Executable File Format specification, though rather vague, has been made available to the public and is included on the Microsoft Developer Network CD (Specs and Strategy, Specifications, Windows NT File Format Specifications). Yet this specification alone does not provide enough information to make it easy, or even reasonable, for developers to understand the PE file format.
The first decent material on the subject was a famous MSDN Magazine article by Matt Pietrek in 1994. — Vano 23:57, 16 July 2013 (UTC)
Does PE support multiple binaries like Mach-O does? It is not clear from the article whether it does or not. Dread Lord CyberSkull ✎☠ 09:34, 29 December 2011 (UTC)
It should be mentioned that PE was originally developed by IBM and that the DOS executable was not as Stub message.
It was similar to Universal Binary. There was two executable for two different platform at same time. They both do the same thing. The latest know example is the windows 98SE installer. there are the same pictures with DOS and windows. OS/2 had no graphic interface in the beginning.
There is two formats on DOS: the first one is .com. It is an unformatted one. You can even boot on it if put one in a Boor sector. The second is .EXE. It is an archive which contain several files and allow relocatable sections. A PE executable is A DOS EXE with certain instructions for stopping the program before the beginning of the other. When windows explorer see a PE header with an icons it opens the archive go into a special folder an extract an .ico file then it display it. It is just for saying PE headers are archive based. It is an neglected aspect. Someone who read the article won't understand it.
When times goes by, DOS usage was decreasing. It didn't worth to develop application for DOS. It is at this time DOS executables started to be STUb message.
When DOS was dropped, they were implementations problems (ex:mingw): it is impossible to have a PE header without a working DOS .exe format. So compiler still continue to generate Stub message. It is the failure of forced compatibility. A normal situation in another case (Other OS) would make the new executable don't work at all. On DOS running a DLL would normaly crash the system. Most people think Stub message were designed for 9x users. But it WRONG because it is no longer the case. It is caused by a design issue
I didn't find a efi file available directly for download. I think it is that should be used for the source.
2A02:8422:1191:6E00:56E6:FCFF:FEDB:2BBA (
talk) 22:39, 16 July 2013 (UTC)
This graphic https://upload.wikimedia.org/wikipedia/commons/7/70/Portable_Executable_32_bit_Structure_in_SVG.svg was so well done and professional looking, that I'd assumed that whoever made it really knew what they were talking about and had done their research. Apparently though, at least on one part of it, they had not. That part is the DataDirectory part. There are only 15 entries in it in the diagram in question. However there are actually supposed to be 16 entries in it, with the last one always blank (filled with 0x00 bytes). I was depending on this diagram for the specs of the PE format, and was using the info shown in this diagram in designing a piece of software I was making. I was trusting that diagram because it looked so well done, that I was assuming it was correct. But it wasn't, as have explained. I found that it was wrong, because my program always was failing to correctly extract data correctly from an EXE file. The section headers (which is what my program was designed to extract) are supposed to start immediately after the DataDirectory, but because your diagram that I was using for my info showed that directory to only have 15 entries, my program was always starting 8 bytes too soon when extracting section headers. I couldn't figure out why, but eventually I decided to scour the net, to see if maybe, just maybe, there was an error in this diagram. It turns out that indeed there is an error in it. It shows the DataDirectory holding only 15 entries, when in fact it should be 16 entries, just with the last entry always empty. After fixing this error, my program worked perfectly.
I don't know how to edit SVG graphics or how to upload any files to Wikipedia. If I did, I'd correct this error myself. So can somebody please fix this? I don't want any other programmers out there to be looking at this diagram, depending on the info it presents when writing their program, and end up getting their program wrong, and then have to go and waste an hour debugging their program like I did, to fix an error that never should have been there to start with. Benhut1 ( talk) 05:42, 10 January 2016 (UTC)
Ok, I finally ended up figuring out how to edit SVG files, and fixed the diagram myself. The new image on this Wiki article is now my edited version of the image. The direct link to the new image is:
https://upload.wikimedia.org/wikipedia/commons/1/1b/Portable_Executable_32_bit_Structure_in_SVG_fixed.svg
Benhut1 (
talk) 18:54, 1 September 2016 (UTC)
Reference number 3: "Microsoft Portable Executable and Common Object File Format Specification, Microsoft Corporation, Revision 6.0 - February 1999" points to https://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/pecoff.doc which is invalid. — Preceding unsigned comment added by 131.91.169.98 ( talk) 18:41, 11 May 2017 (UTC)
Propose merging PE infection with this article and/or Malware: PE infection is a stub with only two sentences and one reference, that can be merged with this article and/or Malware. Luis150902 ( talk | contribs) 20:51, 13 June 2017 (UTC)
PE Infection has been merged into the Malware page. After review of the Portable Executable page, there is no way to fluidly incorporate the concept of PE Infection into the page because at no point does the article discuss security concerns of any kind. -- Baumergrl ( talk) 01:21, 22 October 2017 (UTC)
Two references that point into oblivion, but I found alternatives An In-Depth Look into the Win32 Portable Executable File Format, Part 1 An In-Depth Look into the Win32 Portable Executable File Format, Part 2 -- Dan Oom ( talk) 20:45, 28 February 2019 (UTC)
This article is rated C-class on Wikipedia's
content assessment scale. It is of interest to the following WikiProjects: | |||||||||||||||||||||||||||
|
PE does support position-independent code, it's just that no compiler or linker does. Interix executables compiled with GCC are position-independent PEs —Preceding unsigned comment added by 151.48.66.164 ( talk) 22:48, 21 November 2008 (UTC)
Much of this is inaccurate. The .NET CLR is NOT 'added after the PE/COFF headers' nor does the CLR itself contain the mscoree!_CorExeMain or mscoree!_CorDllMain reference. The CLR header, defined as IMAGE_COR20_HEADER, is referenced through a data directory (#14) in the PE/COFF header. This data directory points to the virtual address and size of the CLR header.
The normal PE/COFF IMPORT table contains the mscoree!_Cor*Main reference. The entry point has a single jmp far instruction into the IAT table entry for this single import.
The IMAGE_COR20_HEADER is used by the CLR when it is loaded into the process space through a .NET aware operating system (WindowsXP+) or through the mscoree!CorExeMain or mscoree!CoreDllMain APIs.
The "PE File Format Diagram" is broken, I don't know the right link... FYI Gil_mo 07:25, 15 July 2007 (UTC)
(and by extension 64-bit) Windows operating systems.
I didn't see any advantages of "yoda's LordPE Deluxe" and "PE Explorer" over "CFF Explorer" tool listed under "Related tools" section. The first one provides very limited set of features and the second one looks like advertisement. Hstab 02:52, 7 August 2007 (UTC)
Djamana ( talk) 03:51, 26 April 2009 (UTC)
This article is poorly written! anyone explain PE format more clearly? Visame ( talk) 18:42, 4 May 2008 (UTC)
What's the difference between Portable Executable and Universal Binary? If I've understood it right Portable Executable is single binary file which has built in binary code for several different architectures while Universal Binary is more like a container for different binaries for different architectures. Is that correct or are both the one and same thing? -- Dekonega ( talk) 13:23, 10 November 2009 (UTC)
32_64_universal
which compiles an application as 32 and 64-bit for both PowerPC and Intel (the resulting executable ending up with instructions for 4 architectures).
Dread Lord CyberSkull
✎☠ 09:33, 29 December 2011 (UTC)I've been reading up on the likelihood that the Xbox console used a somewhat-modified form of the Portable Executable format for its .xbe executable files. Can anyone substantiate this supposition? Did the format translate over the to the Xbox 360? If either answer is affirmative, should those pieces of information be included in the article?— WhosAsking ( talk) 18:40, 13 June 2010 (UTC)
Was PE specification open from the start or was it reverse-engineered and published post factum? 93.175.21.184 ( talk) 16:15, 13 January 2011 (UTC)
The Windows NT version 3.1 operating system introduces a new executable file format called the Portable Executable (PE) file format. The Portable Executable File Format specification, though rather vague, has been made available to the public and is included on the Microsoft Developer Network CD (Specs and Strategy, Specifications, Windows NT File Format Specifications). Yet this specification alone does not provide enough information to make it easy, or even reasonable, for developers to understand the PE file format.
The first decent material on the subject was a famous MSDN Magazine article by Matt Pietrek in 1994. — Vano 23:57, 16 July 2013 (UTC)
Does PE support multiple binaries like Mach-O does? It is not clear from the article whether it does or not. Dread Lord CyberSkull ✎☠ 09:34, 29 December 2011 (UTC)
It should be mentioned that PE was originally developed by IBM and that the DOS executable was not as Stub message.
It was similar to Universal Binary. There was two executable for two different platform at same time. They both do the same thing. The latest know example is the windows 98SE installer. there are the same pictures with DOS and windows. OS/2 had no graphic interface in the beginning.
There is two formats on DOS: the first one is .com. It is an unformatted one. You can even boot on it if put one in a Boor sector. The second is .EXE. It is an archive which contain several files and allow relocatable sections. A PE executable is A DOS EXE with certain instructions for stopping the program before the beginning of the other. When windows explorer see a PE header with an icons it opens the archive go into a special folder an extract an .ico file then it display it. It is just for saying PE headers are archive based. It is an neglected aspect. Someone who read the article won't understand it.
When times goes by, DOS usage was decreasing. It didn't worth to develop application for DOS. It is at this time DOS executables started to be STUb message.
When DOS was dropped, they were implementations problems (ex:mingw): it is impossible to have a PE header without a working DOS .exe format. So compiler still continue to generate Stub message. It is the failure of forced compatibility. A normal situation in another case (Other OS) would make the new executable don't work at all. On DOS running a DLL would normaly crash the system. Most people think Stub message were designed for 9x users. But it WRONG because it is no longer the case. It is caused by a design issue
I didn't find a efi file available directly for download. I think it is that should be used for the source.
2A02:8422:1191:6E00:56E6:FCFF:FEDB:2BBA (
talk) 22:39, 16 July 2013 (UTC)
This graphic https://upload.wikimedia.org/wikipedia/commons/7/70/Portable_Executable_32_bit_Structure_in_SVG.svg was so well done and professional looking, that I'd assumed that whoever made it really knew what they were talking about and had done their research. Apparently though, at least on one part of it, they had not. That part is the DataDirectory part. There are only 15 entries in it in the diagram in question. However there are actually supposed to be 16 entries in it, with the last one always blank (filled with 0x00 bytes). I was depending on this diagram for the specs of the PE format, and was using the info shown in this diagram in designing a piece of software I was making. I was trusting that diagram because it looked so well done, that I was assuming it was correct. But it wasn't, as have explained. I found that it was wrong, because my program always was failing to correctly extract data correctly from an EXE file. The section headers (which is what my program was designed to extract) are supposed to start immediately after the DataDirectory, but because your diagram that I was using for my info showed that directory to only have 15 entries, my program was always starting 8 bytes too soon when extracting section headers. I couldn't figure out why, but eventually I decided to scour the net, to see if maybe, just maybe, there was an error in this diagram. It turns out that indeed there is an error in it. It shows the DataDirectory holding only 15 entries, when in fact it should be 16 entries, just with the last entry always empty. After fixing this error, my program worked perfectly.
I don't know how to edit SVG graphics or how to upload any files to Wikipedia. If I did, I'd correct this error myself. So can somebody please fix this? I don't want any other programmers out there to be looking at this diagram, depending on the info it presents when writing their program, and end up getting their program wrong, and then have to go and waste an hour debugging their program like I did, to fix an error that never should have been there to start with. Benhut1 ( talk) 05:42, 10 January 2016 (UTC)
Ok, I finally ended up figuring out how to edit SVG files, and fixed the diagram myself. The new image on this Wiki article is now my edited version of the image. The direct link to the new image is:
https://upload.wikimedia.org/wikipedia/commons/1/1b/Portable_Executable_32_bit_Structure_in_SVG_fixed.svg
Benhut1 (
talk) 18:54, 1 September 2016 (UTC)
Reference number 3: "Microsoft Portable Executable and Common Object File Format Specification, Microsoft Corporation, Revision 6.0 - February 1999" points to https://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/pecoff.doc which is invalid. — Preceding unsigned comment added by 131.91.169.98 ( talk) 18:41, 11 May 2017 (UTC)
Propose merging PE infection with this article and/or Malware: PE infection is a stub with only two sentences and one reference, that can be merged with this article and/or Malware. Luis150902 ( talk | contribs) 20:51, 13 June 2017 (UTC)
PE Infection has been merged into the Malware page. After review of the Portable Executable page, there is no way to fluidly incorporate the concept of PE Infection into the page because at no point does the article discuss security concerns of any kind. -- Baumergrl ( talk) 01:21, 22 October 2017 (UTC)
Two references that point into oblivion, but I found alternatives An In-Depth Look into the Win32 Portable Executable File Format, Part 1 An In-Depth Look into the Win32 Portable Executable File Format, Part 2 -- Dan Oom ( talk) 20:45, 28 February 2019 (UTC)