> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/malware/optional-header.md).

# Optional header

The optional header structure can either be `IMAGE_OPTIONAL_HEADER` or `IMAGE_OPTIONAL_HEADER64`  depending on the PE architecture. Some key members include:

* **Magic** - A valure that determines whether the iamges is PE32 (i.e 32-bit) or PE32+ (i.e. 64-bit).
* **AddressOfEntryPoint** - the address of the PE's entry point relative to the image base when loaded into memory.
* **ImageBase** - the preferred base address for the PE image to be loaded into.
* **NumberOfRvaAndSizes -** the size of the *DataDirectory* array.
* **DataDirectory** -  an array of `IMAGE_DATA_DIRECTORY` structures.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/d8a35878a30ce2c91590a15d8918b386.png" alt=""><figcaption></figcaption></figure>