Parse a Windows PE Executable Header

Topic Overview

PE Format: Windows Executables

The Portable Executable (PE) format is used for .exe, .dll, and driver files on Windows. If you analyze cross-platform malware or compare Linux ELF with Windows binaries, you need to understand this layout.

PE Structure

A PE file layers several headers:

1. DOS Header (64 bytes): Legacy stub with e_magic = 'MZ' (0x5A4D)
2. PE Signature: 'PE\0\0' at offset given by e_lfanew
3. COFF Header: Machine type, section count, timestamp
4. Optional Header: Entry point, image base, subsystem
5. Section Headers: Names, virtual addresses, raw data pointers

For example, a 64-bit Windows executable has COFF Machine = 0x8664 and optional header Magic = 0x20B (PE32+).

For This Exercise

You will parse DOS and PE headers, verify both magic values, and print machine type, entry point, and section information. Comparing PE with ELF helps you see that both formats solve the same problem (describing loadable code and data) with different field layouts.

PE vs ELF Loading

Windows maps PE sections using VirtualAddress and SizeOfRawData, while ELF uses program headers for loading and section headers for linking. The PE optional header Subsystem field tells you whether the binary expects a console (3) or GUI (2). Cross-platform malware analysts encounter both formats, so recognizing MZ versus ELF magic immediately routes you to the correct parser.

Your Task

Parse the headers of a Windows PE executable:

1. DOS header, 64 bytes: magic 4D 5A ("MZ") at offset 0, and e_lfanew, a 32-bit little-endian offset of the PE header, at 0x3C.
2. At e_lfanew: the signature 50 45 00 00 ("PE\0\0"), then the 20-byte COFF header: Machine (2 bytes), NumberOfSections (2), TimeDateStamp (4), 8 bytes you skip, SizeOfOptionalHeader (2), Characteristics (2).
3. Optional header, right after COFF. Its first 2 bytes are the magic: 0x20B is PE32+ (64-bit) and 0x10B is PE32. AddressOfEntryPoint is at offset 16 and Subsystem at offset 68 in both. ImageBase is 8 bytes at offset 24 in PE32+ but 4 bytes at offset 28 in PE32.

The entry point's virtual address is ImageBase + AddressOfEntryPoint. Machines: 0x8664 x86-64, 0x14C i386, 0xAA64 ARM64, others unknown. Subsystems: 2 GUI, 3 console, others other.

Input

N (1 to 1024), then N bytes in hex.

Output

=== PE Header Parser ===, then for a valid file:

cCopy
Loading…

The PE\0\0 line is printed literally with backslashes. Each check stops the program at the first failure, with one error line (after the lines already printed):

• fewer than 64 bytes: Error: input too short for DOS header (N bytes)
• wrong DOS magic: Error: bad DOS magic (expected 4D 5A 'MZ', got XX XX)
• e_lfanew is 0, or the signature and COFF header would run past N: Error: PE signature at 0x... beyond input (N bytes)
• wrong signature: Error: bad PE signature at offset 0x40
• other optional-header magic: Error: unknown optional header magic 0x0107
• optional header shorter than 70 bytes: Error: optional header truncated