> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/malware/nt-headers.md).

# NT headers

The Windows SDK (Software Development Kit) has two definations for the NT header `IMAGE_NT_HEADERS` for 32-bit PEs and `IMAGE_NT_HEADERS64`  for 64-bit PEs.

* **PE signature**
  * Like the ***e\_magic*** member of the DOS header, the PE signature is a 4-byte DWORD that always has a fixed value **50** **45 00 00** which is **PE\0\0** in ASCII. This is used to verify that the start of the NT header has been correctly located.
* **File header**

  The file header is a structure called `IMAGE_NT_HEADERS` , which has 7 members. Some key ones are:

  * **Machine -** a 2-byte WORD that indicates the CPU architecture the PE is compiled for. The possible values are documented [here](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types).
  * **NumberOfSections -** a WORD that holds the number of sections the PE has (described below).
  * **SizeOfOptionalHeader** - a 2-byte WORD that holds the ssize of the optional header.
  * **Characteristics** - a 2-byte flag that describes some [attributes](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#characteristics) of the PE.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/d56698e6ece4ce71156e978790e4bb1b.png" alt=""><figcaption></figcaption></figure>