PE格式未来是否会变更？解析PE头获取节信息是否可行？

1. Will the PE format change in the future? #

Short answer: Yes, but only in incremental, backward-compatible ways—don’t expect a full overhaul.

PE has been Windows’ core executable format since the 90s, and Microsoft’s top priority with it is maintaining backward compatibility. That said, they’ve extended it repeatedly over the years to support new features: think ARM64 support, Control Flow Guard (CFG), Hypervisor-protected Code Integrity (HVCI), and other security/hardware-related additions. These changes almost always add new fields or sections without breaking existing structures.

A full rewrite of PE is extremely unlikely. Too much existing software—from legacy apps to modern enterprise tools—depends on its current structure. Any major break would cause massive compatibility issues, which Microsoft avoids at all costs. So you can count on PE staying recognizable for the foreseeable future, even as it gets small, targeted updates.

2. Is parsing PE headers for section information compliant and feasible? Should we avoid undocumented PE content? #

First off: Parsing documented PE headers to get section info is totally compliant and standard practice. This is how countless legitimate tools operate: antivirus scanners inspect sections for malicious code, debuggers map executable sections into memory, packers modify sections to compress code, and performance profilers track section-level execution. Microsoft even provides official headers (like winnt.h) that define all the documented PE structures, so using those is encouraged.

Now, about undocumented PE content: This is where you need to be careful. If your code only relies on structures and fields that Microsoft has officially documented (like IMAGE_DOS_HEADER, IMAGE_NT_HEADERS, IMAGE_SECTION_HEADER), you’re in safe territory. But if you start relying on undocumented fields, hidden flags, or non-standard structures that aren’t mentioned in official docs, you’re taking a risk. These undocumented parts can change without warning in Windows updates, which could break your tool or cause it to behave unpredictably.

The rule of thumb here is: Stick to the documented API and structures whenever possible. If you absolutely need to use something undocumented, be prepared to maintain your code through Windows updates and test thoroughly with each new OS release. But for most security development use cases (like inspecting section permissions or content), the documented PE headers are more than sufficient.

内容的提问来源于stack exchange，提问作者Mamone