Anonymous user
PE: Difference between revisions
→64 bit PE: Some info on field expansion
| [unchecked revision] | [unchecked revision] |
(→64 bit PE: Some info on field expansion) |
|||
Line 123:
=64 bit PE=
64 bit PE's are extremely similar to normal PE's, but the machine type, if AMD64, is 0x8664, not 0x14c. This field is directly after the PE signature. The magic number also changes from 0x10b to 0x20b. The magic field is at the beginning of the optional header.
Also several fields have been expanded to 64 bits (but not RVAs or offsets). An example of these is the Preffered Base Address
= See Also =
| |||