You may be thinking now that x64 PE files have all fields with 8 bytes compared to 4 bytes in x86 PE files. But the truth is that PE+ header is very similar to the good old PE header with very few changes as follows:
- ImageBase: It is 8 bytes instead of 4 bytes.
- BaseOfData: This was removed from the Optional header.
- Others: Some other fields, such as SizeOfHeapCommit, SizeOfHeapReserve, SizeOfStackReserve, and SizeOfStackCommit are now 8 bytes instead of 4 bytes.
- Magic: This value changed from 0x10B (representing x86) to 0x20B (representing x64).
PE+ files stayed with the maximum 2 GB size, and all other RVA addresses, including AddressOfEntrypoint, remained 4 bytes.
