--- documentID: "6f11167a8cb160da7e9003a88d302f3b95e4e86a5834dbdaac272e9d25341860" docname: "plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index" title: "LoadConfiguration - PE Analyzers - LIEF Documentation" description: "LoadConfiguration in PE Analyzers. This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja." canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c0819ed70b02bcfdb186ab536d0a91e5ce1e683b63d56785c33c6dd14a5ac2d8" --- # [LoadConfiguration]() This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja. 140011b20  struct Load\_Configuration\_Directory\_Table \_\_load\_configuration\_directory\_table =140011b20  {140011b20      uint32\_t characteristics = 0x140140011b24      uint32\_t timeDateStamp = 0x0140011b28      uint16\_t majorVersion = 0x0140011b2a      uint16\_t minorVersion = 0x0140011b2c      uint32\_t globalFlagsClear = 0x0140011b30      uint32\_t globalFlagsSet = 0x0140011b34      uint32\_t criticalSectionDefaultTimeout = 0x0140011b38      uint64\_t deCommitFreeBlockThreshold = 0x0140011b40      uint64\_t deCommitTotalFreeThreshold = 0x0140011b48      uint64\_t lockPrefixTable = 0x0140011b50      uint64\_t maximumAllocationSize = 0x0140011b58      uint64\_t virtualMemoryThreshold = 0x0140011b60      uint64\_t processAffinityMask = 0x0140011b68      uint32\_t processHeapFlags = 0x0140011b6c      uint16\_t csdVersion = 0x0140011b6e      uint16\_t reserved = 0x0140011b70      uint64\_t editList = 0x0140011b78      uint64\_t securityCookie = 0x140016040140011b80      uint64\_t seHandlerTable = 0x0140011b88      uint64\_t seHandlerCount = 0x0140011b90      uint64\_t guardCFCheckFunctionPointer = 0x140011070140011b98      uint64\_t guardCFDispatchFunctionPointer = 0x140011080140011ba0      uint64\_t guardCFFunctionTable = 0x0140011ba8      uint64\_t guardCFFunctionCount = 0x0140011bb0      uint32\_t guardFlags = 0x100140011bb4      uint16\_t Flags = 0x0140011bb6      uint16\_t Catalog = 0x0140011bb8      uint32\_t CatalogOffset = 0x0140011bbc      uint32\_t Reserved = 0x0140011bc0      uint64\_t guardAddressTakenIatEntryTable = 0x0140011bc8      uint64\_t guardAddressTakenIatEntryCount = 0x0140011bd0      uint64\_t guardLongJumpTargetTable = 0x0140011bd8      uint64\_t guardLongJumpTargetCount = 0x0140011be0      uint64\_t dynamicValueRelocTable = 0x0140011be8      uint64\_t CHPEMetadataPointer = 0x1400111f8140011bf0      uint64\_t guardRFFailureRoutine = 0x0140011bf8      uint64\_t guardRFFailureRoutineFunctionPointer = 0x0140011c00      uint32\_t dynamicValueRelocTableOffset = 0x0140011c04      uint16\_t dynamicValueRelocTableSection = 0x0140011c06      uint16\_t reserved2 = 0x0140011c08      uint64\_t guardRFVerifyStackPointerFunctionPointer = 0x0140011c10      uint32\_t hotPatchTableOffset = 0x0140011c14      uint32\_t reserved3 = 0x0140011c18      uint64\_t enclaveConfigurationPointer = 0x0140011c20      uint64\_t volatileMetadataPointer = 0x0140011c28      uint64\_t guardEHContinuationTable = 0x0140011c30      uint64\_t guardEHContinuationCount = 0x0140011c38      uint64\_t guardXFGCheckFunctionPointer = 0x140011078140011c40      uint64\_t guardXFGDispatchFunctionPointer = 0x140011088140011c48      uint64\_t guardXFGTableDispatchFunctionPointer = 0x140011090140011c50  } 140011b20  struct \_LIEF\_IMAGE\_LOAD\_CONFIG\_DIRECTORY64 \_\_load\_configuration\_directory\_table =140011b20  {140011b20      uint32\_t Size = 0x140140011b24      uint32\_t TimeDateStamp = 0x0140011b28      uint16\_t MajorVersion = 0x0140011b2a      uint16\_t MinorVersion = 0x0140011b2c      uint32\_t GlobalFlagsClear = 0x0140011b30      uint32\_t GlobalFlagsSet = 0x0140011b34      uint32\_t CriticalSectionDefaultTimeout = 0x0140011b38      uintptr\_t DeCommitFreeBlockThreshold = 0x0140011b40      uintptr\_t DeCommitTotalFreeThreshold = 0x0140011b48      void\* LockPrefixTable = 0x0140011b50      uintptr\_t MaximumAllocationSize = 0x0140011b58      uintptr\_t VirtualMemoryThreshold = 0x0140011b60      uintptr\_t ProcessHeapFlags = 0x0140011b68      uint32\_t ProcessAffinityMask = 0x0140011b6c      uint16\_t CSDVersion = 0x0140011b6e      uint16\_t DependentLoadFlags = 0x0140011b70      void\* EditList = 0x0140011b78      void\* SecurityCookie = \_\_security\_cookie140011b80      uintptr\_t\* SEHandlerTable = 0x0140011b88      uintptr\_t SEHandlerCount = 0x0140011b90      void (\*\* GuardCFCheckFunctionPointer)() = \_\_guard\_check\_icall\_fptr140011b98      void (\*\* GuardCFDispatchFunctionPointer)() = \_\_guard\_dispatch\_icall\_fptr140011ba0      uint32\_t\* SEHandlerTable = 0x0140011ba8      uintptr\_t GuardCFFunctionCount = 0x0140011bb0      enum GuardFlags = IMAGE\_GUARD\_CF\_INSTRUMENTED140011bb4      struct CodeIntegrity =140011bb4      {140011bb4          uint16\_t Flags = 0x0140011bb6          uint16\_t Catalog = 0x0140011bb8          uint32\_t CatalogOffset = 0x0140011bbc          uint32\_t Reserved = 0x0140011bc0      }140011bc0      void\* GuardAddressTakenIatEntryTable = 0x0140011bc8      uintptr\_t GuardAddressTakenIatEntryCount = 0x0140011bd0      void\* GuardLongJumpTargetTable = 0x0140011bd8      uintptr\_t GuardLongJumpTargetCount = 0x0140011be0      void\* DynamicValueRelocTable = 0x0140011be8      struct \_LIEF\_IMAGE\_ARM64EC\_METADATA\_V2\* const CHPEMetadataPointer = \_\_image\_arm64ec\_metadata140011bf0      void (\*\* GuardRFFailureRoutine)() = 0x0140011bf8      void (\*\* GuardRFFailureRoutineFunctionPointer)() = 0x0140011c00      uint32\_t DynamicValueRelocTableOffset = 0x0140011c04      uint16\_t DynamicValueRelocTableSection = 0x0140011c06      uint16\_t Reserved2 = 0x0140011c08      void (\*\* GuardRFVerifyStackPointerFunctionPointer)() = 0x0140011c10      uint32\_t HotPatchTableOffset = 0x0140011c14      uint32\_t Reserved3 = 0x0140011c18      void\* EnclaveConfigurationPointer = 0x0140011c20      void\* VolatileMetadataPointer = 0x0140011c28      void\* GuardEHContinuationTable = 0x0140011c30      void\* GuardEHContinuationCount = 0x0140011c38      void (\*\* GuardXFGCheckFunctionPointer)() = data\_140011078140011c40      void (\*\* GuardXFGDispatchFunctionPointer)() = data\_140011088140011c48      void (\*\* GuardXFGTableDispatchFunctionPointer)() = data\_140011090140011c50      void (\*\* CastGuardOsDeterminedFailureMode)() = 0x140011098140011c58      void (\*\* GuardMemcpyFunctionPointer)() = data\_1400110a0140011c60  } The layout of this structure – exposed in LIEF through the `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) interface – evolves frequently across new Windows releases. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types. Beyond the Load Configuration, the analyzer also defines additional structures, such as `lief.PE.CHPEMetadataARM64` ( [`lief::pe::chpe_metadata_arm64::CHPEMetadata`]() ; [`lief.PE.CHPEMetadataARM64`]() ; [`LIEF::PE::CHPEMetadataARM64`]() ), which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering. 1400111e0  00 00 00 00 01 00 00 00 48 65 6c 6c 6f 20 57 6f 72 6c 64 21 0a 00 00 00 02 00 00 00 00 1e 01 00  ........Hello World!............140011200  02 00 00 00 b4 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 00  ............................ ...140011220  00 00 00 00 00 50 01 00 01 00 00 00 01 00 00 00 28 10 01 00 30 10 01 00 00 70 01 00 38 0d 00 00  .....P..........(...0....p..8...140011240  38 10 01 00 48 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 10 01 00 48 10 01 00 50 10 01 00  8...H>..............@...H...P...140011260  58 10 01 00 60 10 01 00 68 10 01 00 00 00 00 00                                                  X...`...h....... 1400111e8  char const data\_1400111e8[0xe] = "Hello World!\n", 01400111f6                                                                    00 00                                                ..1400111f8  struct \_LIEF\_IMAGE\_ARM64EC\_METADATA\_V2 \_\_image\_arm64ec\_metadata =1400111f8  {1400111f8      uint32\_t Version = 0x21400111fc      uint32\_t CodeMap = 0x11e00140011200      uint32\_t CodeMapCount = 0x2140011204      uint32\_t CodeRangesToEntryPoints = 0x11cb4140011208      uint32\_t RedirectionMetadata = 0x1900014001120c      uint32\_t \_\_os\_arm64x\_dispatch\_call\_no\_redirect = 0x11000140011210      uint32\_t \_\_os\_arm64x\_dispatch\_ret = 0x11008140011214      uint32\_t \_\_os\_arm64x\_dispatch\_call = 0x11018140011218      uint32\_t \_\_os\_arm64x\_dispatch\_icall = 0x1101014001121c      uint32\_t \_\_os\_arm64x\_dispatch\_icall\_cfg = 0x11020140011220      uint32\_t AlternateEntryPoint = 0x0140011224      uint32\_t AuxiliaryIAT = 0x15000140011228      uint32\_t CodeRangesToEntryPointsCount = 0x114001122c      uint32\_t RedirectionMetadataCount = 0x1140011230      uint32\_t GetX64InformationFunctionPointer = 0x11028140011234      uint32\_t SetX64InformationFunctionPointer = 0x11030140011238      uint32\_t ExtraRFETable = 0x1700014001123c      uint32\_t ExtraRFETableSize = 0xd38140011240      uint32\_t \_\_os\_arm64x\_dispatch\_fptr = 0x11038140011244      uint32\_t AuxiliaryIATCopy = 0x13e48140011248      uint32\_t AuxDelayloadIAT = 0x014001124c      uint32\_t AuxDelayloadIATCopy = 0x0140011250      uint32\_t ReservedBitField = 0x0140011254  }