May 7, 2025

🧠 What It Does This project is a simple C++ program that parses and prints key information from a Windows Portable Executable (PE) file — such as notepad.exe. Repository: Windows-PE-Header-ParserLanguage: C++ By inspecting the DOS and NT headers, the program extracts metadata used in reverse engineering and malware analysis: 🪄 What Are “Magic Bytes”? Magic bytes are the first few bytes of a file, used to identify its format. The initials “MZ” refer to Mark Zbikowski, one of the original developers of the MS-DOS executable format. These bytes are always found at the very beginning of the file and are crucial for confirming the file type. 📊 Sample Output: 🔧 How It Works (Overview): 🗂️ 1. File Mapping: Instead of reading the file byte by byte, the program uses Windows memory-mapped file APIs to load the entire executable into memory. Here’s what each function does: 📌 Why it matters: This approach is faster and lets you work with the file as a block of memory, which is perfect for binary structure parsing. 📜 2. DOS Header Parsing: At the very start of every PE file is the DOS Header. The program reads the first two bytes of the file to verify they are 0x4D 0x5A — which corresponds to ‘MZ’ in ASCII. 📌 Why it matters: Validating the DOS header ensures we’re working with a proper executable before going deeper. 📍 3. NT Header Location: Within the DOS header, there’s a field called e_lfanew. This gives the offset in the file where the NT Headers (the real “PE” structure) begin. 📌 Why it matters: The DOS header is just a stub. The real meat — entry point, section table, etc. — lives in the NT headers, and this tells us where to look. 🧩 4. PE Header Parsing: Once the program has the address of the NT headers, it reads key fields like: These values come from specific sub-structures inside the NT headers, like IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER. 📌 Why it matters: These values are essential for reverse engineers, malware analysts, or anyone trying to understand how a Windows program behaves under the hood. 🔗 View on GitHub: https://github.com/JasonEiler/Windows-PE-Header-Parser