At the beginning of an object file, or immediately after the signature of an image file, there is a standard COFF header of the following format. Note that the Windows NT loader limits the Number of Sections to 96.
| Offset | Size | Field | Description |
| 0 | 2 | Machine | Number identifying type of target machine. See Section 3.3.1, “Machine Types, ” for more information. |
| 2 | 2 | NumberOfSections | Number of sections; indicates size of the Section Table, which immediately follows the headers. |
| 4 | 4 | TimeDateStamp | Time and date the file was created. |
| 8 | 4 | PointerToSymbolTable | File offset of the COFF symbol table or 0 if none is present. |
| 12 | 4 | NumberOfSymbols | Number of entries in the symbol table. This data can be used in locating the string table, which immediately follows the symbol table. |
| 16 | 2 | SizeOfOptionalHeader | Size of the optional header, which is required for executable files but not for object files. An object file should have a value of 0 here. The format is described in the section “Optional Header.” |
| 18 | 2 | Characteristics | Flags indicating attributes of the file. See Section 3.3.2, “Characteristics,” for specific flag values. |
The Machine field has one of the following values, defined below, which specify its machine (CPU) type. An image file can be run only on the specified machine, or a system emulating it.
| Constant | Value | Description |
| IMAGE_FILE_MACHINE_UNKNOWN | 0x0 | Contents assumed to be applicable to any machine type. |
| IMAGE_FILE_MACHINE_ALPHA | 0x184 | Alpha AXP™. |
| IMAGE_FILE_MACHINE_ARM | 0x1c0 | |
| IMAGE_FILE_MACHINE_ALPHA64 | 0x284 | Alpha AXP™ 64-bit. |
| IMAGE_FILE_MACHINE_I386 | 0x14c | Intel 386 or later, and compatible processors. |
| IMAGE_FILE_MACHINE_IA64 | 0x200 | Intel IA64™ |
| IMAGE_FILE_MACHINE_M68K | 0x268 | Motorola 68000 series. |
| IMAGE_FILE_MACHINE_MIPS16 | 0x266 | |
| IMAGE_FILE_MACHINE_MIPSFPU | 0x366 | MIPS with FPU |
| IMAGE_FILE_MACHINE_MIPSFPU16 | 0x466 | MIPS16 with FPU |
| IMAGE_FILE_MACHINE_POWERPC | 0x1f0 | Power PC, little endian. |
| IMAGE_FILE_MACHINE_R3000 | 0x162 | |
| IMAGE_FILE_MACHINE_R4000 | 0x166 | MIPS® little endian. |
| IMAGE_FILE_MACHINE_R10000 | 0x168 | |
| IMAGE_FILE_MACHINE_SH3 | 0x1a2 | Hitachi SH3 |
| IMAGE_FILE_MACHINE_SH4 | 0x1a6 | Hitachi SH4 |
| IMAGE_FILE_MACHINE_THUMB | 0x1c2 |
The Characteristics field contains flags that indicate attributes of the object or image file. The following flags are currently defined:
| Flag | Value | Description |
| IMAGE_FILE_RELOCS_STRIPPED | 0x0001 | Image only, Windows CE, Windows NT and above. Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. Operating systems running on top of MS-DOS (Win32s™) are generally not able to use the preferred base address and so cannot run these images. However, beginning with version 4.0, Windows will use an application’s preferred base address. The default behavior of the linker is to strip base relocations from EXEs. |
| IMAGE_FILE_EXECUTABLE_IMAGE | 0x0002 | Image only. Indicates that the image file is valid and can be run. If this flag is not set, it generally indicates a linker error. |
| IMAGE_FILE_LINE_NUMS_STRIPPED | 0x0004 | COFF line numbers have been removed. |
| IMAGE_FILE_LOCAL_SYMS_STRIPPED | 0x0008 | COFF symbol table entries for local symbols have been removed. |
| IMAGE_FILE_AGGRESSIVE_WS_TRIM | 0x0010 | Aggressively trim working set. |
| IMAGE_FILE_LARGE_ADDRESS_AWARE | 0x0020 | App can handle > 2gb addresses. |
| IMAGE_FILE_16BIT_MACHINE | 0x0040 | Use of this flag is reserved for future use. |
| IMAGE_FILE_BYTES_REVERSED_LO | 0x0080 | Little endian: LSB precedes MSB in memory. |
| IMAGE_FILE_32BIT_MACHINE | 0x0100 | Machine based on 32-bit-word architecture. |
| IMAGE_FILE_DEBUG_STRIPPED | 0x0200 | Debugging information removed from image file. |
| IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP | 0x0400 | If image is on removable media, copy and run from swap file. |
| IMAGE_FILE_SYSTEM | 0x1000 | The image file is a system file, not a user program. |
| IMAGE_FILE_DLL | 0x2000 | The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run. |
| IMAGE_FILE_UP_SYSTEM_ONLY | 0x4000 | File should be run only on a UP machine. |
| IMAGE_FILE_BYTES_REVERSED_HI | 0x8000 | Big endian: MSB precedes LSB in memory. |