Portable Executable
From Free net encyclopedia
{{Infobox file format | name = Portable Executable | icon = | extension = .exe, .obj, .dll | mime = | owner = Microsoft | genre = Binary, executable, object, shared libraries | containerfor = | containedby = | extendedfrom = COFF | extendedto = }} The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems. The term "portable" refers to the format's portability across all 32-bit (and by extension 64-bit) Windows operating systems. The PE format is basically a data structure that encapsulates the information necessary for the Windows OS loader to manage the wrapped executable code. This includes dynamic library references for linking, API export and import tables, resource management data and thread-local storage (TLS) data. On NT operating systems, the PE format is used for EXE, DLL, OBJ, SYS (device driver), and other file types.
PE is a modified version of the Unix COFF file format. PE/COFF is an alternative term in Windows development.
On Windows NT operating systems, PE currently supports the IA-32, IA-64, and AMD64/EM64T (or "x86-64") instruction set architectures. Before Windows 2000, Windows NT, and thus PE, supported the MIPS, DEC Alpha, and PowerPC instruction set architectures. Because PE is used on Windows CE, it continues to support several variants of the MIPS architecture, and also supports the ARM (including Thumb) and SuperH instruction set architectures.
Contents |
Brief history
Microsoft migrated to the PE format with the introduction of the Windows NT 3.1 operating system. All later versions of Windows, including Windows 95/98/ME, support the file structure. The format has retained limited legacy support to bridge the gap between DOS-based and NT systems. For example, PE/COFF headers still include an MS-DOS executable program, which is by default a stub that displays the simple message "This program cannot be run in DOS mode" (or similar). PE also continues to serve the changing Windows platform. Some extensions include the .NET PE format (see below), a 64-bit version called PE32+ (sometimes PE+), and a specification for Windows CE.
.NET, metadata, and the PE format
Microsoft's .NET Framework has extended the PE format with features which support the Common Language Runtime (an implementation of the .NET Virtual Machine). Among the additions are a CLR Header and CLR Data section. Upon loading a binary, the OS loader yields execution to the CLR via a reference in the PE/COFF IMPORT table. The CLR VM then loads CLR Header and Data sections.
The CLR Data section contains two important segments: Metadata and Intermediate Language (IL) code:
- Metadata contains information relevant to the assembly, including the assembly manifest. A manifest describes the assembly in detail including unique indentification (via a hash, version number, etc.), data on exported components, extensive type information (supported by the Common Type System (CTS)), external references, and a list of files within the assembly. The CLR environment makes extensive use of metadata.
- Intermediate Language (IL) code is abstracted, language independent code that satisfies the .NET CLR's Common Intermediate Language (CIL) requirement. The term "Intermediate" refers to the nature of IL code as cross-language and cross-platform compatible. This intermediate language, similar to bytecode in the Java programming language, allows platforms and languages to support the common .NET CLR (rather than vice versa). IL supports object-oriented programming (polymorphism, inheritance, abstract types, etc.), exceptions, events, and various data structures. IL code is assembled into a .NET PE for execution by the CLR.
Use on other operating systems
The PE format is used by a number of other operating systems, including ReactOS and SkyOS. BeOS R3 on x86 also used PE, before moving to ELF.
See also
Related tools
- PEBrowse a Portable Executable (Win32) file viewer/dissection utility
- PEDUMP
- PE Explorer(not freeware) a PE file viewer/editor, also provides an API function syntax lookup, dependency viewer, section editor, and a disassembler for generating annotated code dumps.
- GNU Binutils with --target=i386-pe, --target=mips-pe etc.
- Anywhere PE Viewer is a free tool for exploring PE files (headers, export table, import table, resources). It is a pure Java application.
External links
- Microsoft Portable Executable and Common Object File Format Specification
- The original Portable Executable article by Matt Pietrek (MSDN Magazine, March 1994)
- Part I. An In-Depth Look into the Win32 Portable Executable File Format by Matt Pietrek (MSDN Magazine, February 2002)
- Part II. An In-Depth Look into the Win32 Portable Executable File Format by Matt Pietrek (MSDN Magazine, March 2002)
- PE File Format Diagramde:Portable Executable