The header of a COFF (Common Object File Format) file consists of two main parts: the COFF File Header and an optional Optional Header. These headers contain critical metadata that describes the file's structure, type, and machine-specific information, allowing linkers and loaders to properly process the executable or object file. The specific structure and placement of the COFF header can vary slightly between different implementations, such as standard object files versus Microsoft's Portable Executable (PE) format.
COFF File Header
The COFF File Header is a fixed-size structure located at the beginning of a standard COFF file. In Microsoft's PE/COFF files, it appears after the PE signature. This header provides fundamental information required for processing the file.
| Field Name | Size (Bytes) | Description |
|---|---|---|
f_magic |
2 | A "magic number" that identifies the target machine architecture. This allows a loader to recognize the intended CPU, such as 0x14c for Intel x86 or 0x8664 for AMD64. |
f_nscns |
2 | The number of sections in the file. This value indicates the size of the Section Table that immediately follows the headers. |
f_timdat |
4 | A timestamp indicating when the file was created. The value is the number of seconds since the Unix epoch (January 1, 1970). |
f_symptr |
4 | A file offset pointing to the COFF Symbol Table, or zero if no symbol table is present. For images (executables), this is typically zero as COFF debugging information is often deprecated. |
f_nsyms |
4 | The number of entries in the symbol table. This is used to calculate the location of the String Table, which follows the Symbol Table. This value is also typically zero for executables. |
f_opthdr |
2 | The size of the optional header that follows the file header. For object files, this value should be zero since an optional header is not required. |
f_flags |
2 | A set of flags indicating the attributes of the file, such as whether it is a DLL, an executable image, or if certain information (like relocations or line numbers) has been stripped. |
Optional Header (for executable files)
The Optional Header is only present in executable files (images) and immediately follows the File Header. It provides additional information needed by the operating system's loader to prepare the file for execution. The header is called "optional" because object files do not need it, but it is required for executables.
The Optional Header itself is composed of three parts: standard fields, Windows-specific fields, and data directories.
Standard fields
This section contains general information relevant across different COFF implementations.
| Field Name | Size (Bytes) | Description |
|---|---|---|
Magic |
2 | A magic number identifying the PE format. 0x10b for PE32 (32-bit) and 0x20b for PE32+ (64-bit). |
MajorLinkerVersion |
1 | The linker's major version number. |
MinorLinkerVersion |
1 | The linker's minor version number. |
SizeOfCode |
4 | The size of the .text section, or the sum of all code sections. |
SizeOfInitializedData |
4 | The size of the initialized data sections. |
SizeOfUninitializedData |
4 | The size of the uninitialized data (.bss) sections. |
AddressOfEntryPoint |
4 | The Relative Virtual Address (RVA) of the entry point, or starting address, of the executable when loaded into memory. |
BaseOfCode |
4 | The RVA of the beginning of the code section. |
BaseOfData |
4 | (PE32 only) The RVA of the beginning of the data section. |
Windows-specific fields
These fields are extensions to the standard COFF format, added by Microsoft to support Windows-specific features.
| Field Name | Size (Bytes) | Description |
|---|---|---|
ImageBase |
4/8 | The preferred starting address of the image in memory. 8 bytes for PE32+. |
SectionAlignment |
4 | The alignment of sections in memory. |
FileAlignment |
4 | The alignment of the raw data sections in the image file. |
MajorOperatingSystemVersion |
2 | The major version number of the required OS. |
MinorOperatingSystemVersion |
2 | The minor version number of the required OS. |
SizeOfImage |
4 | The total size of the image when loaded into memory. |
SizeOfHeaders |
4 | The combined size of all headers. |
CheckSum |
4 | The image file's checksum. |
Subsystem |
2 | The required subsystem to run this image (e.g., GUI, console). |
| ... | ... | Other Windows-specific information.... |
Data directories
This is a table of address and size pairs (RVA/Size) that points to other important structures within the file, such as the import and export tables.
The COFF header in context
The COFF header acts as a map for the rest of the file. By parsing this initial structure, a linker or loader can find all other necessary components of the file, including:
- Section Table: Contains an entry for each section (e.g.,
.text,.data,.bss), describing its size, location, and flags. - Raw Data Sections: The actual code and data for each section.
- Relocation Table(s): Used by linkers and loaders to adjust addresses based on where the file is loaded into memory.
- Symbol Table: Contains information about functions, variables, and other symbols defined or referenced by the file.
- String Table: Stores string names for symbols or sections that are longer than eight characters.