3.4.2 Optional Header Windows NT-Specific Fields (Image Only)

The next twenty-one fields are an extension to the COFF Optional Header format and contain additional information needed by the linker and loader in Windows NT.

Offset Size Field Description
28 4 ImageBase Preferred address of first byte of image when loaded into memory; must be a multiple of 64K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 95, and Windows 98 is 0x00400000.
32 4 SectionAlignment Alignment (in bytes) of sections when loaded into memory. Must greater or equal to File Alignment. Default is the page size for the architecture.
36 4 FileAlignment Alignment factor (in bytes) used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64K inclusive. The default is 512. If the SectionAlignment is less than the architecture's page size than this must match the SectionAlignment.
40 2 MajorOperatingSystemVersion Major version number of required OS.
42 2 MinorOperatingSystemVersion Minor version number of required OS.
44 2 MajorImageVersion Major version number of image.
46 2 MinorImageVersion Minor version number of image.
48 2 MajorSubsystemVersion Major version number of subsystem.
50 2 MinorSubsystemVersion Minor version number of subsystem.
52 4 Reserved dd
56 4 SizeOfImage Size, in bytes, of image, including all headers; must be a multiple of Section Alignment.
60 4 SizeOfHeaders Combined size of MS-DOS stub, PE Header, and section headers rounded up to a multiple of FileAlignment.
64 4 CheckSum Image file checksum. The algorithm for computing is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that ends up in the server.
68 2 Subsystem Subsystem required to run this image. See "Windows NT Subsystem" below for more information.
70 2 DllCharacteristics See "DLL Characteristics" below for more information.
72 4 SizeOfStackReserve Size of stack to reserve. Only the Stack Commit Size is committed; the rest is made available one page at a time, until reserve size is reached.
76 4 SizeOfStackCommit Size of stack to commit.
80 4 SizeOfHeapReserve Size of local heap space to reserve. Only the Heap Commit Size is committed; the rest is made available one page at a time, until reserve size is reached.
84 4 SizeOfHeapCommit Size of local heap space to commit.
88 4 LoaderFlags Obsolete.
92 4 NumberOfRvaAndSizes Number of data-dictionary entries in the remainder of the Optional Header. Each describes a location and size.

Windows NT Subsystem

The following values are defined for the Subsystem field of the Optional Header. They determine what, if any, Windows NT subsystem is required to run the image.

Constant Value Description
IMAGE_SUBSYSTEM_UNKNOWN 0 Unknown subsystem.
IMAGE_SUBSYSTEM_NATIVE 1 Used for device drivers and native Windows NT processes.
IMAGE_SUBSYSTEM_WINDOWS_GUI 2 Image runs in the Windows® graphical user interface (GUI) subsystem.
IMAGE_SUBSYSTEM_WINDOWS_CUI 3 Image runs in the Windows character subsystem.
IMAGE_SUBSYSTEM_POSIX_CUI 7 Image runs in the Posix character subsystem.
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 Image runs in on Windows CE

DLL Characteristics

The following values are defined for the DllCharacteristics field of the Optional Header.

Constant Value Description
0x0001 Reserved
0x0002 Reserved
0x0004 Reserved
0x0008 Reserved
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000 Driver is a WDM Driver