PE files
In order to successfully implement a patch, we need to understand the PE file format (PE stands for portable executable). While a detailed specification may be obtained at this URL, http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx, we only need to understand a few things about the format and be able to manually parse its basic structure.
Headers
A PE file contains several headers and the first one we encounter is the DOS header, which only contains two things that are interesting for us; the first is the MZ signature and the second is the offset of the file header, also known as the PE header (as it is preceded by the PE\x0\x0 signature). The file header contains basic information about the file such as, for example, the number of sections.
Following the PE header is the optional header, which, in turn, contains even more interesting information such as ImageBase, --the address at which the image (file) should preferably be loaded, --and NumberOfRvaAndSizes, and the...
