# Windows PE / Linux ELF / Mach-O Binary Header, Section, Import & Export Inspector

Upload a PE-COFF (.exe/.dll), ELF or Mach-O binary and parse its headers end to end: DOS/PE signature, COFF machine, optional header (entry point, image base, subsystem, ASLR/NX/CFG), section table with RVA↔offset mapping, import/export directories, ELF program headers and PIE detection, dynamic symbols and DT_NEEDED, Mach-O load commands and dylibs — with cross-architecture annotations and a hex preview.

> Canonical page: https://elysiatools.com/en/tools/windows-pe-linux-elf-mach-o-binary-header-section-import-export-inspector

- **Category:** Development

- **Keywords:** PE file, ELF header, Mach-O, binary inspector, COFF header, import table, export table, section table, PIE, reverse engineering

## Overview

After magic detection the parser walks each structure: MZ → e_lfanew → PE\0\0 → COFF (machine, characteristics) → optional header (0x10B PE32 / 0x20B PE32+; entry point, image base, subsystem, DllCharacteristics for ASLR/NX/CFG/high-entropy VA; 16 data directories) → section table (name, virtual size, RVA, raw pointer, R/W/X flags), with RVA→file-offset resolution through section ranges feeding the import directory (DLL names + hint/name thunks) and export directory. ELF: e_ident (class, endianness, OS ABI), e_type (ET_DYN + PT_INTERP ⇒ PIE), program and section header tables, .dynsym/.dynstr symbol names, DT_NEEDED dependencies from .dynamic. Mach-O: 32/64-bit header (cputype, filetype, MH_* flags such as PIE/DYLDLINK/NO_HEAP_EXECUTION) and load commands (LC_SEGMENT_64 with sections, LC_SYMTAB, LC_UUID, LC_MAIN entry offset, LC_LOAD_DYLIB/LC_ID_DYLIB), plus byte-swapped magic detection. Pure TypeScript — no native FFI or WASM — files are parsed locally in bounded memory.

## Inputs

- **Binary file (.exe/.dll/.so/.dylib/.o/.bin, ≤20MB)** (file): sample-pe64-x64-console.exe

## When to use

- Verify binary hardening flags such as ASLR, NX/DEP, CFG, and PIE before software deployment.
- Inspect DLL, SO, or dylib dependencies along with imported and exported symbol tables during debugging.
- Map Relative Virtual Addresses (RVA) to file offsets and inspect raw binary headers via hex preview.

## How it works

- Detects binary magic bytes to identify whether the target file is a Windows PE, Linux ELF, or macOS Mach-O executable.
- Walks header structures including COFF, Optional Headers, ELF program/section headers, and Mach-O load commands.
- Translates virtual address spaces and section tables to map import descriptors, export directories, and dynamic link records directly to their file offsets.
- Generates an interactive HTML summary highlighting machine architectures, entry points, security badges, and an initial hex preview entirely in client-side TypeScript.

## Use cases

- Auditing release binaries for required security mitigations like stack protection, NX, and ASLR.
- Diagnosing missing shared library dependencies or unresolved symbols across cross-compiled artifacts.
- Reverse engineering binary headers to locate section offsets, entry points, and load commands without native tooling.

## Frequently asked questions

### What binary formats and architectures does this tool support?

It parses PE-COFF (.exe, .dll, .sys), ELF (.so, .o, .elf), and Mach-O (.dylib, binaries) across architectures including x86, x86-64, ARM, AArch64, and RISC-V.

### Are my binary files uploaded to a remote server?

No. All parsing, section mapping, and header inspections are executed locally in your browser using pure TypeScript.

### What is the maximum file size supported?

The inspector accepts binary files up to 20 MB.

### How does the inspector detect Position Independent Executables (PIE)?

For ELF, it checks for an ET_DYN type combined with a PT_INTERP segment; for PE and Mach-O, it evaluates dynamic base flags and MH_PIE load commands.

### Can I view both 32-bit and 64-bit binaries?

Yes. The parser supports 32-bit and 64-bit variants, including PE32/PE32+, ELF32/ELF64, and 32-bit/64-bit Mach-O formats.

## Related tools

- [APNG IDAT/fdAT Chunk, Streaming Deflate Replay and Disposal Method Frame-Timing Analyzer](https://elysiatools.com/en/tools/apng-idat-fdat-chunk-streaming-deflate-replay-and-disposal-method-analyzer): Upload a PNG or APNG and audit the whole animation structure: PNG signature and per-chunk CRC32 checks, IHDR bit depth / color type / interlace, acTL placement and declared frame counts, every fcTL (region bounds inside the canvas, normalized delay fractions, dispose_op none/background/previous, blend_op source/over), the shared fcTL+fdAT sequence-number contract from 0, per-frame replay of the IDAT/fdAT deflate streams with exact decompressed-size verification, and disposal-semantics audit — first-frame PREVIOUS treated as BACKGROUND, zero-delay frames, loop counts, fps and compression ratios.
- [NSFW Image Content Detector](https://elysiatools.com/en/tools/nsfw-image-detector): AI content-moderation classifier using NSFWJS to flag uploaded images as safe or potentially inappropriate. Built for moderation and compliance review of your own files — it analyzes uploads only and is not an image search or discovery tool. Supports JPEG/PNG/WEBP/GIF.
- [Convert GIF to Raw Pixel Buffer](https://elysiatools.com/en/tools/gif-to-raw): Export GIF frames as raw pixel buffer data for analysis, rendering pipelines, and low-level image processing.
- [HDR AVIF to SDR PNG Tone Mapper](https://elysiatools.com/en/tools/hdr-avif-to-sdr-png): Decode PQ or HLG AVIF, convert BT.2020 to sRGB, and tone map highlights into a viewable SDR PNG.
- [HEIC to JPG Converter](https://elysiatools.com/en/tools/heic-to-jpg): Decode HEIC photos to compatible JPEG with quality, chroma subsampling, and background controls.
- [Image Difference](https://elysiatools.com/en/tools/image-difference): Calculate the difference between two images to identify changes or create comparison masks
- [Markdown to PDF Converter - Markdown转PDF转换器](https://elysiatools.com/en/tools/markdown-to-pdf-converter): Convert Markdown files to PDF documents with proper formatting, syntax highlighting, and styling
- [Image Color Palette Extractor](https://elysiatools.com/en/tools/image-color-palette-extractor): Extract dominant colors from an image, export code-ready tokens, and check contrast ratios

## Samples

- [Windows Image Processing C++ Samples](https://elysiatools.com/en/samples/windows-image-processing-cpp): Windows C++ image processing examples including reading/saving images, resizing, and format conversion using Windows Imaging Component (WIC)
- [Windows Image Processing - C# Samples](https://elysiatools.com/en/samples/windows-image-processing-csharp): Comprehensive C# image processing examples for Windows platform including image manipulation, filtering, format conversion, and advanced computer vision operations
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Windows File Operations - C++ Samples](https://elysiatools.com/en/samples/windows-file-operations-cpp): Comprehensive C++ file operations examples for Windows platform including text file I/O, file copying, and directory traversal