Following the File header, the Optional header comes with way more information, as shown here:
Figure 3: Optional header explained
The most important values from this header are as follows:
- Magic: This identifies the platform this PE file supports (whether it's x86 or x64).
- AddressOfEntryPoint: This is a very important field for our analysis and it points to the starting point of program execution (to the first assembly instruction to be executed in the program).
- ImageBase: This is the address where the program was designed to be loaded in the virtual memory. If the program has a relocation section, it can be moved somewhere else if it overlaps with another executable loaded at the same address.
- SectionAlignment: The size of each section and all headers' size should be aligned to this value while loaded in the memory (generally, this value is 0x1000).
- FileAlignment: The size of each section in the PE file (and as well the size of all headers) has to be aligned...
