Skip to content

Conversation

ZhangMengRou
Copy link

Both exe and dll are PE files.
[]byte{0x4D, 0x5A} is PE's magic number

Differentiation:

> IMAGE_FILE_DLL
> 0x2000
> The  image  is  a  DLL  file.  While  it  is  an  executable  file,  it  cannot  be  run  directly

Thanks.

Source:
https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header?redirectedfrom=MSDN
https://docs.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)?redirectedfrom=MSDN

@ayoubfaouzi
Copy link

would be nice to get this one merged, though I would like to have a unified type called PE, and then additional input like dll, exe or driver would be extra information.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants