And it follows this 64 byte structure here: Important ones are: [Magic Numbers]. LFANEW - pointer to the NT Header