Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the PEI format?

I understand that PE is a modified version of COFF, and that PE+ is a modified version of PE with 64 bit support, but what is PEI? Am I correct in saying there is no difference between PE and PEI, and they can be used interchangeably?

like image 377
Jeroen Avatar asked Jan 08 '15 19:01

Jeroen


2 Answers

"The sole difference between the pe format and the pei format is that the latter has an MSDOS 2.0 .exe header on the front that prints the message "This app must be run under Windows." (or some such). (FIXME: Whether that statement is really true or not is unknown. Are there more subtle differences between pe and pei formats? For now assume there aren't. If you find one, then for God sakes document it here!)

The Microsoft docs use the word "image" instead of "executable" because the former can also refer to a DLL (shared library). Confusion can arise because the i' in pei' also refers to "image". The `pe' format can also create images (i.e. executables), it's just that to run on a win32 system you need to use the pei format."

Source :

http://www.opensource.apple.com/source/gdb/gdb-1515/src/bfd/libpei.h

like image 62
flydev Avatar answered Oct 24 '22 02:10

flydev


PEI isn't actually an officially recognized format or term. The PE/COFF standard describes only two formats: PE32 (the 32-bit format) and PE32+ (the 64-bit format). I have heard discussions about PE vs PEI before, but the only place I've ever come across the term PEI is in libpei, referenced in the answer by JEdot. And, as quoted in that answer, the libpei developers seem to be confused about the terminology themselves, so it really does not make sense to use the term PEI at all.

Moreover, it is not correct that the MS-DOS stub is required to run a PE executable on Windows. It is just commonly embedded for backwards compatibility.

like image 31
Erlend Graff Avatar answered Oct 24 '22 03:10

Erlend Graff