what is the maximum size of a PE file on 64-bit Windows?

Question

It seems to me it\'s always going to be 4GB, because it uses the same size datatype (A DWORD)? Isn\'t a DWORD for the SizeOfImage always going to be 32-bits? Or

Answer 1

The ImageSize field in the PE headers is largely unrelated to the file size on-disk of the PE file. ImageSize is the in-memory size of the loaded image i.e. the size of all sections (each rounded to the SectionAlignment boundary) + size of the PE headers (given in the next header field, SizeOfHeaders). This value cannot be > 2GB for either PE32 or PE32+ because a) the spec says so and b) there exist 31-bit RVAs in the spec, e.g. in the import lookup table. RVAs are memory references given as offsets from the in-memory base address.

That's in memory though. The file on disk can contain data that is not loaded into memory (e.g. debug data, cert data). File pointer fields in the PE spec are 32-bit unsigned values. So the theoretical maximum size of a PE file according to the spec is 4GB.

That's according to the spec. There may be file-system, loader, OS limits outside of the PE spec that reduce the maximum further.