Click here to Skip to main content
14,603,097 members

Parse a PE (EXE, DLL, OCX Files ) and New Dependency Walker

Rate this:
4.55 (20 votes)
Please Sign up or sign in to vote.
4.55 (20 votes)
28 May 2012CDDL
A brief and basic explanation about the PE data structures, with a sample


I am introducing a new dependency walker, with a new look, but my target is not to introduce a dependency walker in front of you, but rather to make you familiar with PE (Portable Executable) format. I hope all of you have heard about PE, it is nothing but our Windows Executable (EXE, DLL, OCX, etc.) which is actually inherited from COFF (Common Object File Format), which was used for object file and executable in UNIX.

With this article, I make you familiar with coding making your own dependency walker, so that you can customize and make your own dependency walker. More than that, you can learn about PE, and how to parse a PE file with simplicity. To explain more, I am attaching an application and source code named ExeInside.


The term "Portable Executable" was chosen because the intent was to have a common file format for all versions of Windows, on all supported CPUs. To a large extent, this goal has been achieved with the same format used on Windows NT and descendants, Windows 95 and descendants, and Windows CE.

To get familiar with PE format, firstly get familiar with some of the data structures, which are used to manage the data inside an executable in Windows.

  • PE Headers
  • PE Sections
  • Imports
  • Exports
  • Resources
  • Closing

Using the Code

Before compling the code, make sure that you have Microsoft Platform SDK installed properly. Current project is made for Visual Studio 6.0, but can be converted to later versions.

All the structures mentioned below are defined in WINNT.h file. Since PE file is basically starts withMS DOS header MZ header, to get further knowledge like import and export headers, you need to parse further based on the offset so that you can even get DEBUG information.

Let me introduce the data structures commonly used for coding with PE file format:

I am only explaining some of the data structures, if you need more information, you can refer to MSDN.

IMAGE_DOS_HEADER: Data structure holds the header of DOS, or simply the starting address from which we can take reference to get the content of a PE file.

IMAGE_OPTIONAL_HEADER: The data structure holds the import and export address, it holds the starting address for import and export based on the offset.

_IMAGE_EXPORT_DIRECTORY: This data structure holds the export address, based on this address we can get the exported functions of PE file.

IMAGE_IMPORT_DESCRIPTOR: This data structure holds the import address, based on this address we can get the imported functions of PE file.

Examples are illustrated below:

// This code loads a Module (say a DLL) and its start address 
// is given as the base address of the DOS header.
hMod = LoadLibrary( lpctszModName_i )

// This code get the optional header from DOS 
// header based on the offset from DOS header.
        (IMAGE_OPTIONAL_HEADER*)((BYTE*)hMod + IDH->e_lfanew + 24);
// This code gets the import descriptor from the base 
// address by taking the offset of start address and address of       
// you can get the imported functions or ordinals.
IOH->DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
// Same as above code below will give the Export information.
_IMAGE_EXPORT_DIRECTORY* pExportDescriptor = 
               (_IMAGE_EXPORT_DIRECTORY*)((BYTE*)hMod + 

Points of Interest

I am giving you a small example with an implementation that will surely help you understand how our dependency walker may have been coded, but never compare with it, just a overview. I cannot compare my code with the Mark E. Russinovich. Leave those things, this is my first article, and I will surely write a lot of articles only if it is helpful to you. If it is not worthy or if you have any suggestions, then please inform me. I am planning for more topics, if my lord allows me to write it.


This ExeInside Beta is an application written just to understand how a dependency walker works, and still I am trying to improve it more effectively, I will never say it's fully bug free, yet it tested up to some extent and it has some additional functionality like, you can specify a PE file (EXE, DLL, OCX) and specify a directory, it will search which PE files have dependency with the specified PE file.

Well I am expecting your cooperation to make it more better than ever.

For more information, go and understand the below link for study purpose


  • 2nd June, 2009: Initial post
  • 29th May, 2012: Minor corrections.


This article, along with any associated source code and files, is licensed under The Common Development and Distribution License (CDDL)


About the Author

Adam Roderick J
Software Developer (Senior) Philips HealthCare
India India
I am always looking for new technical challenges.
If you face it, contact me, I will solve it.

Comments and Discussions

QuestionException thrown: read access violation. pCurrentSection was 0x220228. Pin
Member 1270087425-Aug-16 4:04
MemberMember 1270087425-Aug-16 4:04 
QuestionHow I can to read process memory from special address? Pin
mobtadi28-Nov-15 7:49
Membermobtadi28-Nov-15 7:49 
QuestionHi, I am trying to uninstall applications silently.. Pin
Nitin R G8-Dec-14 2:53
MemberNitin R G8-Dec-14 2:53 
Questionan error is found when compile the code Pin
joshua013730-May-12 23:02
Memberjoshua013730-May-12 23:02 
AnswerRe: an error is found when compile the code Pin
Adam Roderick J4-Jun-12 0:35
MemberAdam Roderick J4-Jun-12 0:35 
AnswerRe: an error is found when compile the code Pin
Adam Roderick J24-Dec-15 5:03
MemberAdam Roderick J24-Dec-15 5:03 
GeneralMy vote of 3 Pin
Yaroslav.Liulko29-May-12 6:06
MemberYaroslav.Liulko29-May-12 6:06 
General[My vote of 2] to much hard coded.. Pin
marc ochsenmeier5-May-10 4:29
Membermarc ochsenmeier5-May-10 4:29 
GeneralRe: [My vote of 2] to much hard coded.. Pin
Adam Roderick J16-Nov-13 2:55
MemberAdam Roderick J16-Nov-13 2:55 
GeneralMy vote of 2 Pin
marc ochsenmeier5-May-10 4:25
Membermarc ochsenmeier5-May-10 4:25 
GeneralCrash with some dlls (with bug fix) Pin
Laurent Regnier11-Jun-09 2:11
professionalLaurent Regnier11-Jun-09 2:11 
General[Message Deleted] Pin
Adam Roderick J23-Jun-09 6:19
MemberAdam Roderick J23-Jun-09 6:19 
GeneralRe: Crash with some dlls (with bug fix) Pin
Eric Haddan29-Jun-09 14:33
MemberEric Haddan29-Jun-09 14:33 
GeneralMissing things compared to MS Dependency Walker Pin
Joel Lucsy2-Jun-09 10:13
MemberJoel Lucsy2-Jun-09 10:13 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Posted 2 Jun 2009


76 bookmarked