Optional Header: Where the Loader Looks

• Magic: 0x10B = PE32 (32-bit), 0x20B = PE32+ (64-bit). This is how you tell the bitness.
• AddressOfEntryPoint: RVA where execution begins (the first instruction the loader jumps to).
• ImageBase: preferred load address in memory (e.g. 0x400000 for many EXEs).
• SectionAlignment vs FileAlignment: how sections are aligned in memory vs on disk (memory alignment is larger).
• Subsystem: GUI (2), Console (3), Native/driver (1), etc.
• SizeOfImage: total size when mapped into memory.
• DataDirectory[]: array of (RVA, size) pairs pointing to tables — imports, exports, resources, relocations, TLS, and more.