These structures represent the header(s) of an NT image.
There are two ways to read the image:
- Loading the executable/library in memory and then reading the content at the beginning.
- Reading the process' memory at the beginning (base address).
In the case of a loaded library, its header(s) can be found at its load (base) address.
By reading the header(s) we can gather useful info regarding the process, such as the architecture and, in the case of a library, the address of an exported symbol.
