Guided path: Loader & runtime
Step 2 of 5
PE format
Headers, sections, imports, relocations, and the on-disk structure of Windows images.
Official Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
If you want to understand executable layout, imports, ASLR, and why tools can inspect modules, you need the PE model.
Mental model
A PE file is a contract telling Windows how to map an image, where sections belong, and what metadata the loader must honor.
How it works
- 1The DOS stub and PE headers identify the file as a Windows image.
- 2Section headers describe how code, data, resources, and other content are laid out.
- 3Import, export, relocation, and optional header data guide the loader's next steps.
Key terms
- Section
- A named region of a PE image such as code, data, or resources.
- Relocation
- Metadata used when the image cannot be loaded at its preferred base address.
Why one EXE can load different DLL versions on different machines
The image carries dependency metadata, but the final modules and addresses still depend on the actual runtime environment and search rules.
Common misconception
The PE file is not only 'the code'. It also carries the metadata the Windows loader needs to bring that code to life.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
DLL loader, PEB, and module lists
How Windows loads shared libraries and tracks runtime module state.
Next step in your guided path
expert
WOW64 and cross-architecture compatibility
How 32-bit user-mode applications run on a 64-bit Windows system.
Natural next depth in this branch
intermediate
VAD tree
How Windows tracks ranges of virtual memory for a process.
Related topic