PE Loader

The goal was understanding exactly what the Windows loader does when you call LoadLibrary, by implementing the same process manually, just the PE/COFF spec and WinDbg open in another window. Memory gets allocated at the image's preferred base via VirtualAlloc, sections get copied from PointerToRawData into the correct virtual offsets, and import resolution walks the IMAGE_IMPORT_DESCRIPTOR array, patching FirstThunk entries with GetProcAddress results, including the ordinal-import case, where the high bit of the thunk changes how the lookup has to be done.

The hardest part was base relocations: when an image loads at a different address than its preferred ImageBase, every absolute address baked into the binary is wrong by a delta, and the .reloc section's typed entries (HIGHLOW, DIR64) have to be walked and patched correctly, which took multiple sessions stepping through ntdll's actual relocation code in WinDbg to verify the deltas were landing on the right addresses. TLS callbacks firing before the entry point is the detail most writeups skip entirely.