Skip to content

Conversation

ZhangMengRou
Copy link

Both exe and dll are PE files.
[]byte{0x4D, 0x5A} is PE's magic number

Differentiation:

> IMAGE_FILE_DLL
> 0x2000
> The  image  is  a  DLL  file.  While  it  is  an  executable  file,  it  cannot  be  run  directly

Thanks.

Source:
https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header?redirectedfrom=MSDN
https://docs.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)?redirectedfrom=MSDN

@ayoubfaouzi
Copy link

would be nice to get this one merged, though I would like to have a unified type called PE, and then additional input like dll, exe or driver would be extra information.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants