Resources - PeLib

Reference

PE Format Resources

Here are some links to documents, articles and other resources about the PE (Portable Executable) file format. Some of these documents are hosted directly on our space, while others are external links to authoritative reference websites.

Primary Technical Documents

The Portable Executable File Format from Top to Bottom By Randy Kath • Comprehensive paper on structural PE parsing

The PE File Format Guide By Bernd Luevelsmeyer • Essential reference tutorial

Microsoft Portable Executable and COFF Specification Official Microsoft specification documentation page

ECMA and ISO/IEC C# CLI Standards Standards for Common Language Infrastructure (ECMA-335) metadata

Articles & Tutorials

Peering Inside the PE: A Tour of the Win32 Portable Executable File Format By Matt Pietrek • A seminal MSDN article detailing PE headers, section maps, imports, and exports

Under the Hood (July 1997) By Matt Pietrek • Landmark column detailing structural DLL loading mechanisms and EAT base address offsets

An In-Depth Look into the Win32 Portable Executable File Format (Part I) By Matt Pietrek • Detailed technical walkthrough of PE/COFF directory offsets and base relocations

An In-Depth Look into the Win32 Portable Executable File Format (Part II) By Matt Pietrek • In-depth structural examination of IAT binding, delay loads, and TLS directories

Solving the Mysteries of the Loader in Windows 2000 By Russ Osterlund • Visual system analysis of ntdll image loading and virtual memory mappings

Ange Albertini's PE101 Visual Layout Guide Ange Albertini's byte-by-byte visual poster guide to MZ headers and executable boundary tricks

OSDev Wiki Portable Executable Reference Kernel developers' reference guide covering section flags and COFF directory parameters

Iczelion's Classic Win32 PE Tutorials Step-by-step classic tutorials for manipulating binary directories directly in Assembly (x86)