hy there

i got a file, after loading it into a hex editor it turned out that its in the PE/COFF format. So iam searching for the characteristics to look up wich kind of file it is. I found the following Number "0x210E". I've never seen this number. What kind of file is it?

thx for help :)

bye

apo
Posted on 2003-09-28 01:00:19 by apocalexiz
The PE file format is the format of executable binaries of all windows platforms (hence the name PE, that is "portable executable"). It derives from the COFF (common object file format) of unix platform. This is the format of files with the following extension: .exe (executable), .dll (dynamic link library), .ocx (activeX control), .cpl (control panel applet), .drv (driver) and so on...
My suggestion is to read some article like COFF specifications from http://support.microsoft.com/default.aspx?scid=kb;en-us;q121460 and the useful "An In-Depth Look into the Win32 Portable Executable File Format" by Matt Pietrek (part 1 & part 2).
I hope this helps!
Posted on 2003-09-28 14:31:00 by Benji
What do you mean with
I found the following Number "0x210E".
? Where is located this number in the file?
Posted on 2003-09-28 14:33:29 by Benji
damn ;) sometimes i'm very stupid...:grin: i understood something wrong in the PE description from MS (the big pdf) i interpreted the flag values wrong... :)

thx for help guys

bye

apo
Posted on 2003-09-28 14:46:03 by apocalexiz