From the above graphs I know there are 9 sections,but why in the 1st graph it shows 0900?
How to read numbers in PE format?
views:
18answers:
1
A:
The number is little endian, so the least significant byte comes first. Reverse the bytes to get the value in the order usually used by people, i.e. 0x0009.
Matti Virkkunen
2010-09-20 14:51:07
Is it the case for all PE files?
COMer
2010-09-20 15:23:30
@COMer: A quick google reveals at least this: http://www.thehackerslibrary.com/?p=377 which would say that all data is indeed in little endian format.
Matti Virkkunen
2010-09-20 15:33:20