PE format TL;DR: Windows executable container — sections, IAT, EAT, base relocations. Read it once, refer to it forever. Stub — to be filled in. What it is TODO Preconditions / where it applies TODO Technique TODO Detection and defence TODO References https://learn.microsoft.com/en-us/windows/win32/debug/pe-format