Portable executable structure explanation

Question

I am learning the structure of a portable executable. I went through the MSDN article but I am a bit confused about it. I have some confusion with their precise stucture and its functionality.

Can anybody help me or please refer me to a nice article for this?

Answer 1

This is the official current PE/COFF spec from MSFT: http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx

Answer 2

For a more discursive approach than official specs, you should really have a look at Matt Pietrek article "An In-Depth Look into the Win32 Portable Executable File Format" (part 1, part 2). It is explained quite well, and it's much more readable than the dry, official style of the specs.

Answer 3

You should take a look to the excellent representation of the PE Format at http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf.

Some (64Bits) fields are missing, but it is up to 99% close to the reality.

I used this schema to work on a product to analyze PE Files, which you can be download at www.winitor.net/en/pestudio.html. Hope it helps.