Message 2 of 3
06 Mar 18 21:48
Join Date: 08 Sep 2005
Posts To This List: 10257
PE File typing
The PE header can tell you kernel VS user mode. A service exe is the same a
normal exe, so no, the PE header won't tell you. You have to look to at the
imports to infer what the binary's runtime functionality is.
Bent from my phone
From: email@example.com on behalf of firstname.lastname@example.org
Sent: Tuesday, March 6, 2018 3:29:15 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] PE File typing
I am looking for ways to identify different kinds of PE files like services,
versus DLLs versus drivers versus regular PE exe files.
Is there a way ti classify all this from the PE headers, or is the only way to
assertively do this is to look at the export tables?
--- NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on
crash dump analysis, WDF, Windows internals and software drivers! Details at To
unsubscribe, visit the List Server section of OSR Online at