The Windows PE loader follows these steps while loading an executable PE file into memory (including dynamic link libraries):
- Parsing the headers: Windows first starts with parsing the DOS header to find the PE header and then parses the PE header (File header and Optional header) to gather some important information:
-
- ImageBase: To load the PE file (if possible) at this address in its virtual memory.
- NoOfSections: To be used in loading the sections.
- SizeOfImage: As this will be the final size of the whole PE file after being loaded in memory, this value will be used to allocate the space initially.
- Parsing section table: Using the NoOfSections field, it parses all the sections in the PE file and makes sure to get all the necessary information, including their addresses and sizes in memory (VirtualAddress and VirtualSize respectively), as well as the pointer and the size of the section on the hard disk for reading its data.
- Mapping the file in memory...