The next twenty-one fields are an extension to the COFF Optional Header format and contain additional information needed by the linker and loader in Windows NT.
Offset | Size | Field | Description |
28 | 4 | ImageBase | Preferred address of first byte of image when loaded into memory; must be a multiple of 64K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 95, and Windows 98 is 0x00400000. |
32 | 4 | SectionAlignment | Alignment (in bytes) of sections when loaded into memory. Must greater or equal to File Alignment. Default is the page size for the architecture. |
36 | 4 | FileAlignment | Alignment factor (in bytes) used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64K inclusive. The default is 512. If the SectionAlignment is less than the architecture's page size than this must match the SectionAlignment. |
40 | 2 | MajorOperatingSystemVersion | Major version number of required OS. |
42 | 2 | MinorOperatingSystemVersion | Minor version number of required OS. |
44 | 2 | MajorImageVersion | Major version number of image. |
46 | 2 | MinorImageVersion | Minor version number of image. |
48 | 2 | MajorSubsystemVersion | Major version number of subsystem. |
50 | 2 | MinorSubsystemVersion | Minor version number of subsystem. |
52 | 4 | Reserved | dd |
56 | 4 | SizeOfImage | Size, in bytes, of image, including all headers; must be a multiple of Section Alignment. |
60 | 4 | SizeOfHeaders | Combined size of MS-DOS stub, PE Header, and section headers rounded up to a multiple of FileAlignment. |
64 | 4 | CheckSum | Image file checksum. The algorithm for computing is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that ends up in the server. |
68 | 2 | Subsystem | Subsystem required to run this image. See "Windows NT Subsystem" below for more information. |
70 | 2 | DllCharacteristics | See "DLL Characteristics" below for more information. |
72 | 4 | SizeOfStackReserve | Size of stack to reserve. Only the Stack Commit Size is committed; the rest is made available one page at a time, until reserve size is reached. |
76 | 4 | SizeOfStackCommit | Size of stack to commit. |
80 | 4 | SizeOfHeapReserve | Size of local heap space to reserve. Only the Heap Commit Size is committed; the rest is made available one page at a time, until reserve size is reached. |
84 | 4 | SizeOfHeapCommit | Size of local heap space to commit. |
88 | 4 | LoaderFlags | Obsolete. |
92 | 4 | NumberOfRvaAndSizes | Number of data-dictionary entries in the remainder of the Optional Header. Each describes a location and size. |
The following values are defined for the Subsystem field of the Optional Header. They determine what, if any, Windows NT subsystem is required to run the image.
Constant | Value | Description |
IMAGE_SUBSYSTEM_UNKNOWN | 0 | Unknown subsystem. |
IMAGE_SUBSYSTEM_NATIVE | 1 | Used for device drivers and native Windows NT processes. |
IMAGE_SUBSYSTEM_WINDOWS_GUI | 2 | Image runs in the Windows® graphical user interface (GUI) subsystem. |
IMAGE_SUBSYSTEM_WINDOWS_CUI | 3 | Image runs in the Windows character subsystem. |
IMAGE_SUBSYSTEM_POSIX_CUI | 7 | Image runs in the Posix character subsystem. |
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI | 9 | Image runs in on Windows CE |
The following values are defined for the DllCharacteristics field of the Optional Header.
Constant | Value | Description |
0x0001 | Reserved | |
0x0002 | Reserved | |
0x0004 | Reserved | |
0x0008 | Reserved | |
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER | 0x2000 | Driver is a WDM Driver |