0xHabib

PE Header Explorer

Interactive viewer for the Portable Executable (PE) file format structures. Explore the DOS Header, NT Headers, and Optional Header fields used by the Windows Loader.

By 0xHabib•December 20, 2025•
Post Related
#malware-analysis
#pe-format
#reverse-engineering

The Portable Executable (PE) format is the standard for executables, object code, and DLLs in Windows. This tool visualizes the critical headers managed by the Windows Loader.

Key Structures

  • DOS Header: Legacy header starting with MZ. Contains e_lfanew pointing to NT Headers.
  • NT Headers: Contains the PE Signature (PE\0\0), File Header (machine type, sections), and Optional Header.
  • Optional Header: The most critical data for the loader, including the Entry Point, Image Base, and Data Directories (Exports, Imports, Relocations).
0xPE Header Structure
Interactive visualization of the Portable Executable (PE) header format parsed by RtlLoadPeHeaders.
0x0000
IMAGE_DOS_HEADER
... DOS Stub ...
0x00E0
NT Signature
+0x04
IMAGE_FILE_HEADER
+0x18
IMAGE_OPTIONAL_HEADER

IMAGE_DOS_HEADER

Legacy MS-DOS header. The first 64 bytes of every PE file.

Offset: 0x0000
Size: 64 bytes
FieldTypeValue (Example)Description
e_magicWORD0x5A4D ('MZ')Magic number identifying the file.
e_lfanewLONG0x00E0Offset to the NT headers.