Glossary
PE Format
Portable Executable — the binary file format used by Windows executables (.exe, .dll, .sys) that defines headers, sections, and import tables.
The PE (Portable Executable) format is the binary container Windows uses for executables (.exe), dynamic libraries (.dll), and kernel drivers (.sys). A PE file begins with the legacy DOS stub and MZ header, followed by the PE signature and COFF header, then the Optional Header (which contains the entry point RVA and data-directory pointers), and finally the section table. Key sections include .text (code), .data (globals), and .rdata (read-only data and the Import Address Table). Recognizing the PE structure is foundational to static analysis of Windows malware.