EXE
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
Windows PE Preview.
At a glance
| Purpose | A Windows Portable Executable (PE32 or PE32+) program, and through routes of the same module, DLLs, drivers, controls and other PE images. |
| Extensions | .exe |
| Poka parser | poka-pe |
| Viewer | poka-tree-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B3 Core (see Breadth tiers) |
How much Poka reads
B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-pe/src/main.rs (1353 lines) and plugin.json. 21 unit tests cover the header walk, PE32+, imports, resource-only images and refusing NE, LE and LX images; the corpus has no .exe sample. Covers .exe. The tree shows the header (format, type, machine, subsystem, entry point, image base, section count, linker version, timestamp, characteristics, DLL characteristics), every section with size, flags and role, the imports by DLL and function, and the populated data directories with RVA and size. Judgement: B3: the structure and imports are decoded, but the export table, resources, version information and signature are only listed as directories.
What Poka does not read
- The export table is not decoded (exported functions are not listed)
- Resources (icons, version information, manifests, dialogs, strings) are not decoded
- The Authenticode signature is not read or verified
- .NET (CLR) metadata, TLS callbacks and delay imports are listed as directories only
- Code is not disassembled
- Files over 64 MiB are cut without a flag; caps of 3,000 nodes
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- goblin (candidate; MIT; Rust; https://github.com/m4b/goblin) — PE headers/sections/imports
- authenticode (candidate; MIT OR Apache-2.0; Rust; https://github.com/google/authenticode-rs) — signature extraction
Sources
- parsers/poka-pe/src/main.rs
- parsers/poka-pe/plugin.json