Search notes:

Portable Executable

The Portable Executable Format (PE) is the main binary format on Windows and a modification of the Common Object File Format (COFF).
Interestingly, COFF was used in Unix before it was replaced by ELF.
Because of the history of PE, it is sometimes also referred to as PE/COFF.
PE32+ is the 64-bit (sic!) variant of PE.

Modules

DLLs and EXEs are commonly referred to as modules.
The WinAPI function GetModuleHandle() returns a module handle (a HMODULE (and sometimes also a HINSTANCE?)) for a module that is loaded into the process that calls this function.
The value of the HMODULE/HINSTANCE is the address of the DOS/PE header of the loaded DLL in memory.

PE Header

An image's PE Header stores (among others) the information whether the image is a Console or GUI application.

Sections (aka Segments?)

.data global variables
.text compiled (executable) code
.pdata X64: contains an array of function table entries for exception handling; is pointed to by the .xdata table entry in the image data directory.
.xdata Unwind information
.debug
.drectve Can be shown with the command line option /directives of dumpbin.exe.
.pdata (?) Exception tables (Risc Processors only), see also dumpbin /pdata.
.CorFlags (?, see also CorFlags.exe)
The dumpbin.exe command line option /sections:… restricts the output of dumpbin to the given section.

See also

dumpbin.exe and editbin.exe.
PEVerify.exe
The method GetHINSTANCE of the .NET class System.Runtime.InteropServices.Marshal.
Don't confuse abbreviation PE with Windows PE.
DLL
EXE

Links

docs.microsoft.com: PE Format

Index