Posts Tagged: 64bit

For 64-bit executables/PE files, there are a couple of changes in the PE header offsets. Don’t consider the size of the OptionalHeader as 0x74, instead use the “SizeOfOptionalHeader” from the _IMAGE_FILE_HEADER. There is no longer a BaseOfData field, instead ImageBase is 8 bytes long. More details onĀ _IMAGE_OPTIONAL_HEADER64 you can foundĀ here.

Scroll To Top