NT Headers: Signature + File Header + Optional Header

At e_lfanew we find three parts:

• Signature: 4 bytes — the letters P, E followed by two zero bytes ("PE00", i.e. 0x50 0x45 0x00 0x00).
• File Header (IMAGE_FILE_HEADER): coarse facts about the file.
• Optional Header (IMAGE_OPTIONAL_HEADER): not optional at all — it holds the fields the loader needs most.

File Header key fields

• Machine: target CPU (0x14C = x86, 0x8664 = x64).
• NumberOfSections: how many section headers follow.
• TimeDateStamp: build time (often faked / zeroed).
• Characteristics: flags (executable image, DLL, etc.).