About the magic number of PE

2019-07-20 02:40发布

问题:

0x10b : PE32 executable
0×107 : ROM image
0x20b : PE32+ (64 bit) executable

What is the ROM image?

回答1:

Interesting question, I've dabbled with manipulating PE files but never noticed that.

Here's what I believe they are used for: A ROM image can be executed 'in place' (XIP), if you search MSDN for "rom image", you'll find a number of references to it in the Windows Mobile and older Windows CE tools, e.g. Rom Image Creation.

A ROM image can thus be executed directly from the ROM without having to load and relocate it in RAM, which is pretty handy for a mobile device with limited resources.