Image for a PEFile File Structure DOS Header (128 bytes) PE Signature ("PE\0\0") PEFileHeader (20 bytes) PEOptionalHeader (224 bytes) SectionHeaders (40 bytes * NumSections) Sections .text (always present - contains metadata) .sdata (contains any initialised data in the file - may not be present) (for ilams /debug this contains the Debug table) .reloc (always present - in pure CIL only has one fixup) others??? c# produces .rsrc section containing a Resource Table .text layout IAT (single entry 8 bytes for pure CIL) CLIHeader (72 bytes) CIL instructions for all methods (variable size) MetaData Root (20 bytes + UTF-8 Version String + quad align padding) StreamHeaders (8 bytes + null terminated name string + quad align padding) Streams #~ (always present - holds metadata tables) #Strings (always present - holds identifier strings) #US (Userstring heap) #Blob (signature blobs) #GUID (guids for assemblies or Modules) ImportTable (40 bytes) ImportLookupTable(8 bytes) (same as IAT for standard CIL files) Hint/Name Tables with entry "_CorExeMain" for .exe file and "_CorDllMain" for .dll (14 bytes) ASCII string "mscoree.dll" referenced in ImportTable (+ padding = 16 bytes) Entry Point (0xFF25 followed by 4 bytes 0x400000 + RVA of .text) #~ stream structure Header (24 bytes) Rows (4 bytes * numTables) Tables
