1.DOS头
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
WORD e_magic; // Magic number DOS签名 4D5A "MZ"
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
LONG e_lfanew; // File address of new exe header 指向PE头 3Ch
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
2.DOS存根(stub)在DOS头与 PE文件头之间,大小不定。有无皆可。存放DOS环境下运行的指令。
3.PE文件头(NT头)
typedef struct _IMAGE_NT_HEADERS {
DWORD Signature; 50450000h,PE00
IMAGE_FILE_HEADER FileHeader; 文件头
IMAGE_OPTIONAL_HEADER32 OptionalHeader; 可选头
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
参考 :windows环境下32位汇编语言设计 逆向工程核心原理