Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

PEOptionalHeaderTypeWin Executable File Object Schema

The PEOptionalHeaderType type describes the PE Optional Header structure. Additional computed metadata, e.g., hashes of the header, are also included.


Fields

Field Name Type Description
Magic0..1 HexBinaryObjectPropertyType

Specifies the unsigned integer that indicates the type of executable file.

Major_Linker_Version0..1 HexBinaryObjectPropertyType

Specifies the linker major version number.

Minor_Linker_Version0..1 HexBinaryObjectPropertyType

Specifies the linker minor version number.

Size_Of_Code0..1 HexBinaryObjectPropertyType

Specifies the size of the code (text) section. If there are multiple sections, size is the sum of the sizes if each.

Size_Of_Initialized_Data0..1 HexBinaryObjectPropertyType

Specifies the size of the initialized data section. If there are multiple sections, size is the sum of the sizes if each.

Size_Of_Uninitialized_Data0..1 HexBinaryObjectPropertyType

Specifies the size of the uninitialized (bss) data section. If there are multiple sections, size is the sum of the sizes if each.

Address_Of_Entry_Point0..1 HexBinaryObjectPropertyType

Specifies the address of the entry point relative to the image base when the executable is loaded into memory. When there is no entry point (e.g., optional for DLLs), the value should be 0.

Base_Of_Code0..1 HexBinaryObjectPropertyType

Specifies the address that is relative to the image base of the beginning-of-code section when it is loaded into memory.

Base_Of_Data0..1 HexBinaryObjectPropertyType

Specifies the address that is relative to the image base of the beginning-of-data section when it is loaded into memory.

Image_Base0..1 HexBinaryObjectPropertyType

Specifies the preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K.

Section_Alignment0..1 HexBinaryObjectPropertyType

Specifies the alignment (in bytes) of sections when they are loaded into memory.

File_Alignment0..1 HexBinaryObjectPropertyType

Specifies the factor (in bytes) that is used to align the raw data of sections in the image file.

Major_OS_Version0..1 HexBinaryObjectPropertyType

Specifies the major version number of the required operating system.

Minor_OS_Version0..1 HexBinaryObjectPropertyType

Specifies the minor version number of the required operating system.

Major_Image_Version0..1 HexBinaryObjectPropertyType

Specifies the major version number of the image.

Minor_Image_Version0..1 HexBinaryObjectPropertyType

Specifies the minor version number of the image.

Major_Subsystem_Version0..1 HexBinaryObjectPropertyType

Specifies the major version number of the subsystem.

Minor_Subsystem_Version0..1 HexBinaryObjectPropertyType

Specifies the minor version number of the subsystem.

Win32_Version_Value0..1 HexBinaryObjectPropertyType

Reserved; must be 0.

Size_Of_Image0..1 HexBinaryObjectPropertyType

Specifies the size (in bytes) of the image, including all headers, as the image is loaded in memory.

Size_Of_Headers0..1 HexBinaryObjectPropertyType

Specifies the combined size of the MS DOS header, PE header, and section headers rounded up to a multiple of FileAlignment.

Checksum0..1 HexBinaryObjectPropertyType

Specifies the checksum of the PE file.

Subsystem0..1 HexBinaryObjectPropertyType

Specifies the subsystem (e.g., GUI, device driver) that is required to run this image.

DLL_Characteristics0..1 HexBinaryObjectPropertyType

Specifies flags that characterize the PE file.

Size_Of_Stack_Reserve0..1 HexBinaryObjectPropertyType

Specifies the size of the stack to reserve.

Size_Of_Stack_Commit0..1 HexBinaryObjectPropertyType

Specifies the size of the stack to commit.

Size_Of_Heap_Reserve0..1 HexBinaryObjectPropertyType

Specifies the size of the local heap space to reserve.

Size_Of_Heap_Commit0..1 HexBinaryObjectPropertyType

Specifies the size of the local heap space to commit.

Loader_Flags0..1 HexBinaryObjectPropertyType

Reserved; must be 0.

Number_Of_Rva_And_Sizes0..1 HexBinaryObjectPropertyType

Specifies the number of data-directory entries in the remainder of the optional header.

Data_Directory0..1 DataDirectoryType

Specifies the data directories in the remainder in the optional header. This field will be repeated for each data directory.

Hashes0..1 HashListType

The Hashes field is used to include any hash values computed using the specified PE binary optional header as input.