Portable Executable

This includes references for dynamically linked libraries, tables for importing and exporting APIs, resource management data and thread-local storage (TLS) information.

According to the Unified Extensible Firmware Interface (UEFI) specification, the PE format is also the accepted standard for executables in EFI environments.

Moreover, thanks to its use in Windows CE, PE has maintained compatibility with several MIPS, ARM (including Thumb), and SuperH variants.

Notable extensions include the .NET PE format for managed code, PE32+ for 64-bit address space support, and a specialized version for Windows CE.

The dynamic linker maps each section to memory individually and assigns the correct permissions based on the information in the headers.

As the dynamic linker holds modules and resolves dependancies, it populates the IAT slots with actual addresses of the corresponding library functions.

[9] PE files aren't position-independent by default; they are compiled to run at a specific, fixed memory address.

Modern operating systems use Address Space Layout Randomization (ASLR) to make it harder for attackers to exploit memory-related vulnerabilities.

ASLR works by randomly changing the memory address of important parts of the program every time it's loaded.

Mac OS X 10.5 has the ability to load and parse PE files, although it does not maintain binary compatibility with Windows.