Editing Portable Executable (section)

== History ==

Microsoft first introduced the PE format with [[Windows NT 3.1]], replacing the older 16-bit [[New Executable]] (NE) format. Soon after, Windows 95, 98, ME, and the Win32s extension for Windows 3.1x, all adopted the PE structure. Each PE file includes a DOS executable header, which generally displays the message "[[New Executable|This program cannot be run in DOS mode]]". However, this DOS section can be replaced by a fully functional DOS program, as demonstrated in the Windows 98 SE installer. Developers can add such a program using the <code>/STUB</code> switch with Microsoft's linker, effectively creating a [[fat binary]].<ref>{{cite web | url=http://msdn.microsoft.com/en-us/library/7z0585h5.aspx | title=/STUB (MS-DOS Stub File Name) | date=3 August 2021 }}</ref>

Over time, the PE format has grown with the Windows platform. Notable extensions include the [[.NET]] PE format for managed code, PE32+ for 64-bit address space support, and a specialized version for [[Windows Embedded Compact|Windows CE]].

To determine whether a PE file is intended for 32-bit or 64-bit architectures, one can examine the Machine field in the IMAGE_FILE_HEADER.<ref>[https://gdatasoftware.com/blog/pebitnesstrick PE trick explained: Telling 32 and 64 bit apart with naked eye] by Karsten Hahn</ref> Common machine values are <code>0x014c</code> for 32-bit Intel processors and <code>0x8664</code> for x64 processors. Additionally, the Magic field in the <code>IMAGE_OPTIONAL_HEADER</code> reveals whether addresses are 32-bit or 64-bit. A value of <code>0x10B</code> indicates a 32-bit (PE32) file, while <code>0x20B</code> indicates a 64-bit (PE32+) file.<ref>[https://docs.microsoft.com/en-us/windows/win32/debug/pe-format PE Format] at Microsoft.com</ref>