IMAGE_NT_HEADERS32 structure (winnt.h)

Represents the PE header format.

typedef struct _IMAGE_NT_HEADERS {
  DWORD                   Signature;
  IMAGE_FILE_HEADER       FileHeader;
  IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

Signature

A 4-byte signature identifying the file as a PE image. The bytes are "PE\0\0".

FileHeader

An IMAGE_FILE_HEADER structure that specifies the file header.

OptionalHeader

An IMAGE_OPTIONAL_HEADER structure that specifies the optional file header.

The actual structure in WinNT.h is named IMAGE_NT_HEADERS32 and IMAGE_NT_HEADERS is defined as IMAGE_NT_HEADERS32. However, if _WIN64 is defined, then IMAGE_NT_HEADERS is defined as IMAGE_NT_HEADERS64.

typedef struct _IMAGE_NT_HEADERS64 {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;

CheckSumMappedFile

IMAGE_FILE_HEADER

IMAGE_OPTIONAL_HEADER

ImageHlp Structures

ImageNtHeader

ImageRvaToSection

ImageRvaToVa

LOADED_IMAGE

UpdateDebugInfoFile