IMAGE_OPTIONAL_HEADER32 structure (winnt.h)
Represents the optional header format.
Syntax
typedef struct _IMAGE_OPTIONAL_HEADER {
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
Members
Magic
The state of the image file. This member can be one of the following values.
MajorLinkerVersion
The major version number of the linker.
MinorLinkerVersion
The minor version number of the linker.
SizeOfCode
The size of the code section, in bytes, or the sum of all such sections if there are multiple code sections.
SizeOfInitializedData
The size of the initialized data section, in bytes, or the sum of all such sections if there are multiple initialized data sections.
SizeOfUninitializedData
The size of the uninitialized data section, in bytes, or the sum of all such sections if there are multiple uninitialized data sections.
AddressOfEntryPoint
A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero.
BaseOfCode
A pointer to the beginning of the code section, relative to the image base.
BaseOfData
A pointer to the beginning of the data section, relative to the image base.
ImageBase
The preferred address of the first byte of the image when it is loaded in memory. This value is a multiple of 64K bytes. The default value for DLLs is 0x10000000. The default value for applications is 0x00400000, except on Windows CE where it is 0x00010000.
SectionAlignment
The alignment of sections loaded in memory, in bytes. This value must be greater than or equal to the FileAlignment member. The default value is the page size for the system.
FileAlignment
The alignment of the raw data of sections in the image file, in bytes. The value should be a power of 2 between 512 and 64K (inclusive). The default is 512. If the SectionAlignment member is less than the system page size, this member must be the same as SectionAlignment.
MajorOperatingSystemVersion
The major version number of the required operating system.
MinorOperatingSystemVersion
The minor version number of the required operating system.
MajorImageVersion
The major version number of the image.
MinorImageVersion
The minor version number of the image.
MajorSubsystemVersion
The major version number of the subsystem.
MinorSubsystemVersion
The minor version number of the subsystem.
Win32VersionValue
This member is reserved and must be 0.
SizeOfImage
The size of the image, in bytes, including all headers. Must be a multiple of SectionAlignment.
SizeOfHeaders
The combined size of the following items, rounded to a multiple of the value specified in the FileAlignment member.
- e_lfanew member of IMAGE_DOS_HEADER
- 4 byte signature
- size of IMAGE_FILE_HEADER
- size of optional header
- size of all section headers
CheckSum
The image file checksum. The following files are validated at load time: all drivers, any DLL loaded at boot time, and any DLL loaded into a critical system process.
Subsystem
The subsystem required to run this image. The following values are defined.
DllCharacteristics
The DLL characteristics of the image. The following values are defined.
| Value | Meaning |
|---|---|
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
Reserved. |
|
ASLR with 64 bit address space. |
|
The DLL can be relocated at load time. |
|
Code integrity checks are forced. If you set this flag and a section contains only uninitialized data, set the PointerToRawData member of IMAGE_SECTION_HEADER for that section to zero; otherwise, the image will fail to load because the digital signature cannot be verified. |
|
The image is compatible with data execution prevention (DEP). |
|
The image is isolation aware, but should not be isolated. |
|
The image does not use structured exception handling (SEH). No handlers can be called in this image. |
|
Do not bind the image. |
|
Image should execute in an AppContainer. |
|
A WDM driver. |
|
Image supports Control Flow Guard. |
|
The image is terminal server aware. |
SizeOfStackReserve
The number of bytes to reserve for the stack. Only the memory specified by the SizeOfStackCommit member is committed at load time; the rest is made available one page at a time until this reserve size is reached.
SizeOfStackCommit
The number of bytes to commit for the stack.
SizeOfHeapReserve
The number of bytes to reserve for the local heap. Only the memory specified by the SizeOfHeapCommit member is committed at load time; the rest is made available one page at a time until this reserve size is reached.
SizeOfHeapCommit
The number of bytes to commit for the local heap.
LoaderFlags
This member is obsolete.
NumberOfRvaAndSizes
The number of directory entries in the remainder of the optional header. Each entry describes a location and size.
DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]
A pointer to the first IMAGE_DATA_DIRECTORY structure in the data directory.
The index number of the desired directory entry. This parameter can be one of the following values.
Remarks
The number of directories is not fixed. Check the NumberOfRvaAndSizes member before looking for a specific directory.
The actual structure in WinNT.h is named IMAGE_OPTIONAL_HEADER32 and IMAGE_OPTIONAL_HEADER is defined as IMAGE_OPTIONAL_HEADER32. However, if _WIN64 is defined, then IMAGE_OPTIONAL_HEADER is defined as IMAGE_OPTIONAL_HEADER64.
typedef struct _IMAGE_OPTIONAL_HEADER64 {
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows XP [desktop apps only] |
| Minimum supported server | Windows Server 2003 [desktop apps only] |
| Header | winnt.h (include Windows.h) |
See also
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for