This page hosts a formal specification of Microsoft PE (Portable Executable) file format using Kaitai Struct. This specification can be automatically translated into a variety of programming languages to get a parsing library.
digraph {
rankdir=LR;
node [shape=plaintext];
subgraph cluster__microsoft_pe {
label="MicrosoftPe";
graph[style=dotted];
microsoft_pe__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="mz_pos">0</TD><TD PORT="mz_size">64</TD><TD>MzPlaceholder</TD><TD PORT="mz_type">mz</TD></TR>
</TABLE>>];
microsoft_pe__inst__pe [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="pe_pos">mz.ofs_pe</TD><TD PORT="pe_size">...</TD><TD>PeHeader</TD><TD PORT="pe_type">pe</TD></TR>
</TABLE>>];
subgraph cluster__certificate_entry {
label="MicrosoftPe::CertificateEntry";
graph[style=dotted];
certificate_entry__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="length_pos">0</TD><TD PORT="length_size">4</TD><TD>u4le</TD><TD PORT="length_type">length</TD></TR>
<TR><TD PORT="revision_pos">4</TD><TD PORT="revision_size">2</TD><TD>u2le→CertificateRevision</TD><TD PORT="revision_type">revision</TD></TR>
<TR><TD PORT="certificate_type_pos">6</TD><TD PORT="certificate_type_size">2</TD><TD>u2le→CertificateTypeEnum</TD><TD PORT="certificate_type_type">certificate_type</TD></TR>
<TR><TD PORT="certificate_bytes_pos">8</TD><TD PORT="certificate_bytes_size">(length - 8)</TD><TD></TD><TD PORT="certificate_bytes_type">certificate_bytes</TD></TR>
</TABLE>>];
}
subgraph cluster__optional_header_windows {
label="MicrosoftPe::OptionalHeaderWindows";
graph[style=dotted];
optional_header_windows__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="image_base_32_pos">0</TD><TD PORT="image_base_32_size">4</TD><TD>u4le</TD><TD PORT="image_base_32_type">image_base_32</TD></TR>
<TR><TD PORT="image_base_64_pos">4</TD><TD PORT="image_base_64_size">8</TD><TD>u8le</TD><TD PORT="image_base_64_type">image_base_64</TD></TR>
<TR><TD PORT="section_alignment_pos">12</TD><TD PORT="section_alignment_size">4</TD><TD>u4le</TD><TD PORT="section_alignment_type">section_alignment</TD></TR>
<TR><TD PORT="file_alignment_pos">16</TD><TD PORT="file_alignment_size">4</TD><TD>u4le</TD><TD PORT="file_alignment_type">file_alignment</TD></TR>
<TR><TD PORT="major_operating_system_version_pos">20</TD><TD PORT="major_operating_system_version_size">2</TD><TD>u2le</TD><TD PORT="major_operating_system_version_type">major_operating_system_version</TD></TR>
<TR><TD PORT="minor_operating_system_version_pos">22</TD><TD PORT="minor_operating_system_version_size">2</TD><TD>u2le</TD><TD PORT="minor_operating_system_version_type">minor_operating_system_version</TD></TR>
<TR><TD PORT="major_image_version_pos">24</TD><TD PORT="major_image_version_size">2</TD><TD>u2le</TD><TD PORT="major_image_version_type">major_image_version</TD></TR>
<TR><TD PORT="minor_image_version_pos">26</TD><TD PORT="minor_image_version_size">2</TD><TD>u2le</TD><TD PORT="minor_image_version_type">minor_image_version</TD></TR>
<TR><TD PORT="major_subsystem_version_pos">28</TD><TD PORT="major_subsystem_version_size">2</TD><TD>u2le</TD><TD PORT="major_subsystem_version_type">major_subsystem_version</TD></TR>
<TR><TD PORT="minor_subsystem_version_pos">30</TD><TD PORT="minor_subsystem_version_size">2</TD><TD>u2le</TD><TD PORT="minor_subsystem_version_type">minor_subsystem_version</TD></TR>
<TR><TD PORT="win32_version_value_pos">32</TD><TD PORT="win32_version_value_size">4</TD><TD>u4le</TD><TD PORT="win32_version_value_type">win32_version_value</TD></TR>
<TR><TD PORT="size_of_image_pos">36</TD><TD PORT="size_of_image_size">4</TD><TD>u4le</TD><TD PORT="size_of_image_type">size_of_image</TD></TR>
<TR><TD PORT="size_of_headers_pos">40</TD><TD PORT="size_of_headers_size">4</TD><TD>u4le</TD><TD PORT="size_of_headers_type">size_of_headers</TD></TR>
<TR><TD PORT="check_sum_pos">44</TD><TD PORT="check_sum_size">4</TD><TD>u4le</TD><TD PORT="check_sum_type">check_sum</TD></TR>
<TR><TD PORT="subsystem_pos">48</TD><TD PORT="subsystem_size">2</TD><TD>u2le→SubsystemEnum</TD><TD PORT="subsystem_type">subsystem</TD></TR>
<TR><TD PORT="dll_characteristics_pos">50</TD><TD PORT="dll_characteristics_size">2</TD><TD>u2le</TD><TD PORT="dll_characteristics_type">dll_characteristics</TD></TR>
<TR><TD PORT="size_of_stack_reserve_32_pos">52</TD><TD PORT="size_of_stack_reserve_32_size">4</TD><TD>u4le</TD><TD PORT="size_of_stack_reserve_32_type">size_of_stack_reserve_32</TD></TR>
<TR><TD PORT="size_of_stack_reserve_64_pos">56</TD><TD PORT="size_of_stack_reserve_64_size">8</TD><TD>u8le</TD><TD PORT="size_of_stack_reserve_64_type">size_of_stack_reserve_64</TD></TR>
<TR><TD PORT="size_of_stack_commit_32_pos">64</TD><TD PORT="size_of_stack_commit_32_size">4</TD><TD>u4le</TD><TD PORT="size_of_stack_commit_32_type">size_of_stack_commit_32</TD></TR>
<TR><TD PORT="size_of_stack_commit_64_pos">68</TD><TD PORT="size_of_stack_commit_64_size">8</TD><TD>u8le</TD><TD PORT="size_of_stack_commit_64_type">size_of_stack_commit_64</TD></TR>
<TR><TD PORT="size_of_heap_reserve_32_pos">76</TD><TD PORT="size_of_heap_reserve_32_size">4</TD><TD>u4le</TD><TD PORT="size_of_heap_reserve_32_type">size_of_heap_reserve_32</TD></TR>
<TR><TD PORT="size_of_heap_reserve_64_pos">80</TD><TD PORT="size_of_heap_reserve_64_size">8</TD><TD>u8le</TD><TD PORT="size_of_heap_reserve_64_type">size_of_heap_reserve_64</TD></TR>
<TR><TD PORT="size_of_heap_commit_32_pos">88</TD><TD PORT="size_of_heap_commit_32_size">4</TD><TD>u4le</TD><TD PORT="size_of_heap_commit_32_type">size_of_heap_commit_32</TD></TR>
<TR><TD PORT="size_of_heap_commit_64_pos">92</TD><TD PORT="size_of_heap_commit_64_size">8</TD><TD>u8le</TD><TD PORT="size_of_heap_commit_64_type">size_of_heap_commit_64</TD></TR>
<TR><TD PORT="loader_flags_pos">100</TD><TD PORT="loader_flags_size">4</TD><TD>u4le</TD><TD PORT="loader_flags_type">loader_flags</TD></TR>
<TR><TD PORT="number_of_rva_and_sizes_pos">104</TD><TD PORT="number_of_rva_and_sizes_size">4</TD><TD>u4le</TD><TD PORT="number_of_rva_and_sizes_type">number_of_rva_and_sizes</TD></TR>
</TABLE>>];
}
subgraph cluster__optional_header_data_dirs {
label="MicrosoftPe::OptionalHeaderDataDirs";
graph[style=dotted];
optional_header_data_dirs__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="export_table_pos">0</TD><TD PORT="export_table_size">8</TD><TD>DataDir</TD><TD PORT="export_table_type">export_table</TD></TR>
<TR><TD PORT="import_table_pos">8</TD><TD PORT="import_table_size">8</TD><TD>DataDir</TD><TD PORT="import_table_type">import_table</TD></TR>
<TR><TD PORT="resource_table_pos">16</TD><TD PORT="resource_table_size">8</TD><TD>DataDir</TD><TD PORT="resource_table_type">resource_table</TD></TR>
<TR><TD PORT="exception_table_pos">24</TD><TD PORT="exception_table_size">8</TD><TD>DataDir</TD><TD PORT="exception_table_type">exception_table</TD></TR>
<TR><TD PORT="certificate_table_pos">32</TD><TD PORT="certificate_table_size">8</TD><TD>DataDir</TD><TD PORT="certificate_table_type">certificate_table</TD></TR>
<TR><TD PORT="base_relocation_table_pos">40</TD><TD PORT="base_relocation_table_size">8</TD><TD>DataDir</TD><TD PORT="base_relocation_table_type">base_relocation_table</TD></TR>
<TR><TD PORT="debug_pos">48</TD><TD PORT="debug_size">8</TD><TD>DataDir</TD><TD PORT="debug_type">debug</TD></TR>
<TR><TD PORT="architecture_pos">56</TD><TD PORT="architecture_size">8</TD><TD>DataDir</TD><TD PORT="architecture_type">architecture</TD></TR>
<TR><TD PORT="global_ptr_pos">64</TD><TD PORT="global_ptr_size">8</TD><TD>DataDir</TD><TD PORT="global_ptr_type">global_ptr</TD></TR>
<TR><TD PORT="tls_table_pos">72</TD><TD PORT="tls_table_size">8</TD><TD>DataDir</TD><TD PORT="tls_table_type">tls_table</TD></TR>
<TR><TD PORT="load_config_table_pos">80</TD><TD PORT="load_config_table_size">8</TD><TD>DataDir</TD><TD PORT="load_config_table_type">load_config_table</TD></TR>
<TR><TD PORT="bound_import_pos">88</TD><TD PORT="bound_import_size">8</TD><TD>DataDir</TD><TD PORT="bound_import_type">bound_import</TD></TR>
<TR><TD PORT="iat_pos">96</TD><TD PORT="iat_size">8</TD><TD>DataDir</TD><TD PORT="iat_type">iat</TD></TR>
<TR><TD PORT="delay_import_descriptor_pos">104</TD><TD PORT="delay_import_descriptor_size">8</TD><TD>DataDir</TD><TD PORT="delay_import_descriptor_type">delay_import_descriptor</TD></TR>
<TR><TD PORT="clr_runtime_header_pos">112</TD><TD PORT="clr_runtime_header_size">8</TD><TD>DataDir</TD><TD PORT="clr_runtime_header_type">clr_runtime_header</TD></TR>
</TABLE>>];
}
subgraph cluster__data_dir {
label="MicrosoftPe::DataDir";
graph[style=dotted];
data_dir__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="virtual_address_pos">0</TD><TD PORT="virtual_address_size">4</TD><TD>u4le</TD><TD PORT="virtual_address_type">virtual_address</TD></TR>
<TR><TD PORT="size_pos">4</TD><TD PORT="size_size">4</TD><TD>u4le</TD><TD PORT="size_type">size</TD></TR>
</TABLE>>];
}
subgraph cluster__coff_symbol {
label="MicrosoftPe::CoffSymbol";
graph[style=dotted];
coff_symbol__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_annoying_pos">0</TD><TD PORT="name_annoying_size">8</TD><TD>Annoyingstring</TD><TD PORT="name_annoying_type">name_annoying</TD></TR>
<TR><TD PORT="value_pos">8</TD><TD PORT="value_size">4</TD><TD>u4le</TD><TD PORT="value_type">value</TD></TR>
<TR><TD PORT="section_number_pos">12</TD><TD PORT="section_number_size">2</TD><TD>u2le</TD><TD PORT="section_number_type">section_number</TD></TR>
<TR><TD PORT="type_pos">14</TD><TD PORT="type_size">2</TD><TD>u2le</TD><TD PORT="type_type">type</TD></TR>
<TR><TD PORT="storage_class_pos">16</TD><TD PORT="storage_class_size">1</TD><TD>u1</TD><TD PORT="storage_class_type">storage_class</TD></TR>
<TR><TD PORT="number_of_aux_symbols_pos">17</TD><TD PORT="number_of_aux_symbols_size">1</TD><TD>u1</TD><TD PORT="number_of_aux_symbols_type">number_of_aux_symbols</TD></TR>
</TABLE>>];
coff_symbol__inst__section [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">id</TD><TD BGCOLOR="#E0FFE0">value</TD></TR>
<TR><TD>section</TD><TD>_root.pe.sections[(section_number - 1)]</TD></TR>
</TABLE>>];
coff_symbol__inst__data [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="data_pos">(section.pointer_to_raw_data + value)</TD><TD PORT="data_size">1</TD><TD></TD><TD PORT="data_type">data</TD></TR>
</TABLE>>];
}
subgraph cluster__pe_header {
label="MicrosoftPe::PeHeader";
graph[style=dotted];
pe_header__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="pe_signature_pos">0</TD><TD PORT="pe_signature_size">4</TD><TD></TD><TD PORT="pe_signature_type">pe_signature</TD></TR>
<TR><TD PORT="coff_hdr_pos">4</TD><TD PORT="coff_hdr_size">20</TD><TD>CoffHeader</TD><TD PORT="coff_hdr_type">coff_hdr</TD></TR>
<TR><TD PORT="optional_hdr_pos">24</TD><TD PORT="optional_hdr_size">coff_hdr.size_of_optional_header</TD><TD>OptionalHeader</TD><TD PORT="optional_hdr_type">optional_hdr</TD></TR>
<TR><TD PORT="sections_pos">...</TD><TD PORT="sections_size">40</TD><TD>Section</TD><TD PORT="sections_type">sections</TD></TR>
<TR><TD COLSPAN="4" PORT="sections__repeat">repeat coff_hdr.number_of_sections times</TD></TR>
</TABLE>>];
pe_header__inst__certificate_table [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="certificate_table_pos">optional_hdr.data_dirs.certificate_table.virtual_address</TD><TD PORT="certificate_table_size">optional_hdr.data_dirs.certificate_table.size</TD><TD>CertificateTable</TD><TD PORT="certificate_table_type">certificate_table</TD></TR>
</TABLE>>];
}
subgraph cluster__optional_header {
label="MicrosoftPe::OptionalHeader";
graph[style=dotted];
optional_header__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="std_pos">0</TD><TD PORT="std_size">28</TD><TD>OptionalHeaderStd</TD><TD PORT="std_type">std</TD></TR>
<TR><TD PORT="windows_pos">28</TD><TD PORT="windows_size">108</TD><TD>OptionalHeaderWindows</TD><TD PORT="windows_type">windows</TD></TR>
<TR><TD PORT="data_dirs_pos">136</TD><TD PORT="data_dirs_size">120</TD><TD>OptionalHeaderDataDirs</TD><TD PORT="data_dirs_type">data_dirs</TD></TR>
</TABLE>>];
}
subgraph cluster__section {
label="MicrosoftPe::Section";
graph[style=dotted];
section__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_pos">0</TD><TD PORT="name_size">8</TD><TD>str(UTF-8)</TD><TD PORT="name_type">name</TD></TR>
<TR><TD PORT="virtual_size_pos">8</TD><TD PORT="virtual_size_size">4</TD><TD>u4le</TD><TD PORT="virtual_size_type">virtual_size</TD></TR>
<TR><TD PORT="virtual_address_pos">12</TD><TD PORT="virtual_address_size">4</TD><TD>u4le</TD><TD PORT="virtual_address_type">virtual_address</TD></TR>
<TR><TD PORT="size_of_raw_data_pos">16</TD><TD PORT="size_of_raw_data_size">4</TD><TD>u4le</TD><TD PORT="size_of_raw_data_type">size_of_raw_data</TD></TR>
<TR><TD PORT="pointer_to_raw_data_pos">20</TD><TD PORT="pointer_to_raw_data_size">4</TD><TD>u4le</TD><TD PORT="pointer_to_raw_data_type">pointer_to_raw_data</TD></TR>
<TR><TD PORT="pointer_to_relocations_pos">24</TD><TD PORT="pointer_to_relocations_size">4</TD><TD>u4le</TD><TD PORT="pointer_to_relocations_type">pointer_to_relocations</TD></TR>
<TR><TD PORT="pointer_to_linenumbers_pos">28</TD><TD PORT="pointer_to_linenumbers_size">4</TD><TD>u4le</TD><TD PORT="pointer_to_linenumbers_type">pointer_to_linenumbers</TD></TR>
<TR><TD PORT="number_of_relocations_pos">32</TD><TD PORT="number_of_relocations_size">2</TD><TD>u2le</TD><TD PORT="number_of_relocations_type">number_of_relocations</TD></TR>
<TR><TD PORT="number_of_linenumbers_pos">34</TD><TD PORT="number_of_linenumbers_size">2</TD><TD>u2le</TD><TD PORT="number_of_linenumbers_type">number_of_linenumbers</TD></TR>
<TR><TD PORT="characteristics_pos">36</TD><TD PORT="characteristics_size">4</TD><TD>u4le</TD><TD PORT="characteristics_type">characteristics</TD></TR>
</TABLE>>];
section__inst__body [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="body_pos">pointer_to_raw_data</TD><TD PORT="body_size">size_of_raw_data</TD><TD></TD><TD PORT="body_type">body</TD></TR>
</TABLE>>];
}
subgraph cluster__certificate_table {
label="MicrosoftPe::CertificateTable";
graph[style=dotted];
certificate_table__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="items_pos">0</TD><TD PORT="items_size">...</TD><TD>CertificateEntry</TD><TD PORT="items_type">items</TD></TR>
<TR><TD COLSPAN="4" PORT="items__repeat">repeat to end of stream</TD></TR>
</TABLE>>];
}
subgraph cluster__mz_placeholder {
label="MicrosoftPe::MzPlaceholder";
graph[style=dotted];
mz_placeholder__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="magic_pos">0</TD><TD PORT="magic_size">2</TD><TD></TD><TD PORT="magic_type">magic</TD></TR>
<TR><TD PORT="data1_pos">2</TD><TD PORT="data1_size">58</TD><TD></TD><TD PORT="data1_type">data1</TD></TR>
<TR><TD PORT="ofs_pe_pos">60</TD><TD PORT="ofs_pe_size">4</TD><TD>u4le</TD><TD PORT="ofs_pe_type">ofs_pe</TD></TR>
</TABLE>>];
}
subgraph cluster__optional_header_std {
label="MicrosoftPe::OptionalHeaderStd";
graph[style=dotted];
optional_header_std__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="format_pos">0</TD><TD PORT="format_size">2</TD><TD>u2le→PeFormat</TD><TD PORT="format_type">format</TD></TR>
<TR><TD PORT="major_linker_version_pos">2</TD><TD PORT="major_linker_version_size">1</TD><TD>u1</TD><TD PORT="major_linker_version_type">major_linker_version</TD></TR>
<TR><TD PORT="minor_linker_version_pos">3</TD><TD PORT="minor_linker_version_size">1</TD><TD>u1</TD><TD PORT="minor_linker_version_type">minor_linker_version</TD></TR>
<TR><TD PORT="size_of_code_pos">4</TD><TD PORT="size_of_code_size">4</TD><TD>u4le</TD><TD PORT="size_of_code_type">size_of_code</TD></TR>
<TR><TD PORT="size_of_initialized_data_pos">8</TD><TD PORT="size_of_initialized_data_size">4</TD><TD>u4le</TD><TD PORT="size_of_initialized_data_type">size_of_initialized_data</TD></TR>
<TR><TD PORT="size_of_uninitialized_data_pos">12</TD><TD PORT="size_of_uninitialized_data_size">4</TD><TD>u4le</TD><TD PORT="size_of_uninitialized_data_type">size_of_uninitialized_data</TD></TR>
<TR><TD PORT="address_of_entry_point_pos">16</TD><TD PORT="address_of_entry_point_size">4</TD><TD>u4le</TD><TD PORT="address_of_entry_point_type">address_of_entry_point</TD></TR>
<TR><TD PORT="base_of_code_pos">20</TD><TD PORT="base_of_code_size">4</TD><TD>u4le</TD><TD PORT="base_of_code_type">base_of_code</TD></TR>
<TR><TD PORT="base_of_data_pos">24</TD><TD PORT="base_of_data_size">4</TD><TD>u4le</TD><TD PORT="base_of_data_type">base_of_data</TD></TR>
</TABLE>>];
}
subgraph cluster__coff_header {
label="MicrosoftPe::CoffHeader";
graph[style=dotted];
coff_header__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="machine_pos">0</TD><TD PORT="machine_size">2</TD><TD>u2le→MachineType</TD><TD PORT="machine_type">machine</TD></TR>
<TR><TD PORT="number_of_sections_pos">2</TD><TD PORT="number_of_sections_size">2</TD><TD>u2le</TD><TD PORT="number_of_sections_type">number_of_sections</TD></TR>
<TR><TD PORT="time_date_stamp_pos">4</TD><TD PORT="time_date_stamp_size">4</TD><TD>u4le</TD><TD PORT="time_date_stamp_type">time_date_stamp</TD></TR>
<TR><TD PORT="pointer_to_symbol_table_pos">8</TD><TD PORT="pointer_to_symbol_table_size">4</TD><TD>u4le</TD><TD PORT="pointer_to_symbol_table_type">pointer_to_symbol_table</TD></TR>
<TR><TD PORT="number_of_symbols_pos">12</TD><TD PORT="number_of_symbols_size">4</TD><TD>u4le</TD><TD PORT="number_of_symbols_type">number_of_symbols</TD></TR>
<TR><TD PORT="size_of_optional_header_pos">16</TD><TD PORT="size_of_optional_header_size">2</TD><TD>u2le</TD><TD PORT="size_of_optional_header_type">size_of_optional_header</TD></TR>
<TR><TD PORT="characteristics_pos">18</TD><TD PORT="characteristics_size">2</TD><TD>u2le</TD><TD PORT="characteristics_type">characteristics</TD></TR>
</TABLE>>];
coff_header__inst__symbol_table_size [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">id</TD><TD BGCOLOR="#E0FFE0">value</TD></TR>
<TR><TD>symbol_table_size</TD><TD>(number_of_symbols * 18)</TD></TR>
</TABLE>>];
coff_header__inst__symbol_name_table_offset [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">id</TD><TD BGCOLOR="#E0FFE0">value</TD></TR>
<TR><TD>symbol_name_table_offset</TD><TD>(pointer_to_symbol_table + symbol_table_size)</TD></TR>
</TABLE>>];
coff_header__inst__symbol_name_table_size [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="symbol_name_table_size_pos">symbol_name_table_offset</TD><TD PORT="symbol_name_table_size_size">4</TD><TD>u4le</TD><TD PORT="symbol_name_table_size_type">symbol_name_table_size</TD></TR>
</TABLE>>];
coff_header__inst__symbol_table [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="symbol_table_pos">pointer_to_symbol_table</TD><TD PORT="symbol_table_size">18</TD><TD>CoffSymbol</TD><TD PORT="symbol_table_type">symbol_table</TD></TR>
<TR><TD COLSPAN="4" PORT="symbol_table__repeat">repeat number_of_symbols times</TD></TR>
</TABLE>>];
}
subgraph cluster__annoyingstring {
label="MicrosoftPe::Annoyingstring";
graph[style=dotted];
annoyingstring__seq [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
</TABLE>>];
annoyingstring__inst__name_from_offset [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_from_offset_pos">(name_zeroes == 0 ? (_parent._parent.symbol_name_table_offset + name_offset) : 0)</TD><TD PORT="name_from_offset_size">...</TD><TD>str(ignore EOS, ascii)</TD><TD PORT="name_from_offset_type">name_from_offset</TD></TR>
</TABLE>>];
annoyingstring__inst__name_offset [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_offset_pos">4</TD><TD PORT="name_offset_size">4</TD><TD>u4le</TD><TD PORT="name_offset_type">name_offset</TD></TR>
</TABLE>>];
annoyingstring__inst__name [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">id</TD><TD BGCOLOR="#E0FFE0">value</TD></TR>
<TR><TD>name</TD><TD>(name_zeroes == 0 ? name_from_offset : name_from_short)</TD></TR>
</TABLE>>];
annoyingstring__inst__name_zeroes [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_zeroes_pos">0</TD><TD PORT="name_zeroes_size">4</TD><TD>u4le</TD><TD PORT="name_zeroes_type">name_zeroes</TD></TR>
</TABLE>>];
annoyingstring__inst__name_from_short [label=<<TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0">
<TR><TD BGCOLOR="#E0FFE0">pos</TD><TD BGCOLOR="#E0FFE0">size</TD><TD BGCOLOR="#E0FFE0">type</TD><TD BGCOLOR="#E0FFE0">id</TD></TR>
<TR><TD PORT="name_from_short_pos">0</TD><TD PORT="name_from_short_size">...</TD><TD>str(ignore EOS, ascii)</TD><TD PORT="name_from_short_type">name_from_short</TD></TR>
</TABLE>>];
}
}
microsoft_pe__seq:mz_type -> mz_placeholder__seq [style=bold];
mz_placeholder__seq:ofs_pe_type -> microsoft_pe__inst__pe:pe_pos [color="#404040"];
microsoft_pe__inst__pe:pe_type -> pe_header__seq [style=bold];
certificate_entry__seq:length_type -> certificate_entry__seq:certificate_bytes_size [color="#404040"];
optional_header_data_dirs__seq:export_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:import_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:resource_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:exception_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:certificate_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:base_relocation_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:debug_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:architecture_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:global_ptr_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:tls_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:load_config_table_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:bound_import_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:iat_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:delay_import_descriptor_type -> data_dir__seq [style=bold];
optional_header_data_dirs__seq:clr_runtime_header_type -> data_dir__seq [style=bold];
coff_symbol__seq:name_annoying_type -> annoyingstring__seq [style=bold];
pe_header__seq:sections_type -> coff_symbol__inst__section [color="#404040"];
coff_symbol__seq:section_number_type -> coff_symbol__inst__section [color="#404040"];
section__seq:pointer_to_raw_data_type -> coff_symbol__inst__data:data_pos [color="#404040"];
coff_symbol__seq:value_type -> coff_symbol__inst__data:data_pos [color="#404040"];
pe_header__seq:coff_hdr_type -> coff_header__seq [style=bold];
coff_header__seq:size_of_optional_header_type -> pe_header__seq:optional_hdr_size [color="#404040"];
pe_header__seq:optional_hdr_type -> optional_header__seq [style=bold];
pe_header__seq:sections_type -> section__seq [style=bold];
coff_header__seq:number_of_sections_type -> pe_header__seq:sections__repeat [color="#404040"];
data_dir__seq:virtual_address_type -> pe_header__inst__certificate_table:certificate_table_pos [color="#404040"];
data_dir__seq:size_type -> pe_header__inst__certificate_table:certificate_table_size [color="#404040"];
pe_header__inst__certificate_table:certificate_table_type -> certificate_table__seq [style=bold];
optional_header__seq:std_type -> optional_header_std__seq [style=bold];
optional_header__seq:windows_type -> optional_header_windows__seq [style=bold];
optional_header__seq:data_dirs_type -> optional_header_data_dirs__seq [style=bold];
section__seq:pointer_to_raw_data_type -> section__inst__body:body_pos [color="#404040"];
section__seq:size_of_raw_data_type -> section__inst__body:body_size [color="#404040"];
certificate_table__seq:items_type -> certificate_entry__seq [style=bold];
coff_header__seq:number_of_symbols_type -> coff_header__inst__symbol_table_size [color="#404040"];
coff_header__seq:pointer_to_symbol_table_type -> coff_header__inst__symbol_name_table_offset [color="#404040"];
coff_header__inst__symbol_table_size:symbol_table_size_type -> coff_header__inst__symbol_name_table_offset [color="#404040"];
coff_header__inst__symbol_name_table_offset:symbol_name_table_offset_type -> coff_header__inst__symbol_name_table_size:symbol_name_table_size_pos [color="#404040"];
coff_header__seq:pointer_to_symbol_table_type -> coff_header__inst__symbol_table:symbol_table_pos [color="#404040"];
coff_header__inst__symbol_table:symbol_table_type -> coff_symbol__seq [style=bold];
coff_header__seq:number_of_symbols_type -> coff_header__inst__symbol_table:symbol_table__repeat [color="#404040"];
annoyingstring__inst__name_zeroes:name_zeroes_type -> annoyingstring__inst__name_from_offset:name_from_offset_pos [color="#404040"];
coff_header__inst__symbol_name_table_offset:symbol_name_table_offset_type -> annoyingstring__inst__name_from_offset:name_from_offset_pos [color="#404040"];
annoyingstring__inst__name_offset:name_offset_type -> annoyingstring__inst__name_from_offset:name_from_offset_pos [color="#404040"];
annoyingstring__inst__name_zeroes:name_zeroes_type -> annoyingstring__inst__name [color="#404040"];
annoyingstring__inst__name_from_offset:name_from_offset_type -> annoyingstring__inst__name [color="#404040"];
annoyingstring__inst__name_from_short:name_from_short_type -> annoyingstring__inst__name [color="#404040"];
}