[PE format analysis] 3.image_nt_header

The source code is as follows:

struct _image_nt_headers {+00h    //  fixed to 0x00004550  based on small end storage as: "PE ..." +04h    Image_file_header fileheader;+18h    *pimage_nt_headers32;

Signature field

In a valid PE file, the Signature field is set to 0x00004550, and the ASCII code character is "PE00". Marks the beginning of this PE file header.

PE00 "String is the beginning of the PE file header, and the E_lfanew field of the DOS header is pointing here.

As shown in the following:

One more example:

[PE format analysis] 3.image_nt_header