查看Wireshark编译器版本

编译Wireshark插件，一般得与编译Wireshark的版本保持一致，这样才能直接将编译生成的dll插件放入Wireshark/plugins中后直接使用，而不用重新编译整个Wireshark。
Wireshark Version 1.10.1

 

1 使用PEiD确定

可以看到Linker Info为：10.0
VS的Linker版本对应关系为
VC6.0   :   6.0
VS2003  :   7.0
VS2005  :   8.0
VS2008  :   9.0
VS2010  :   10.0
VS2012  :   11.0
VS2013  :   12.0
所以可以确定Wireshark是由VS2010编译生成的

 

2 Linker Info的由来
PE结构中有两个字段MajorLinkerVersion,MinorLinkerVersion分别表示链接器的主副版本号，而这两个字段在IMAGE_OPTIONAL_HEADER结构中。
下面看下Wireshare.exe中的主副版本号是多少

2.1 PE结构

有关PE结构的定义在WINNT.h中，VC6的路径为D:\Program Files\Microsoft Visual Studio\VC98\Include

 

2.2 Wireshark前0x130字节内容

00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0801 0000  ................
00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!..L.!Th
00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno
00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS 
00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......
00000080: ef6e 031b ab0f 6d48 ab0f 6d48 ab0f 6d48  .n....mH..mH..mH
00000090: a277 ee48 a90f 6d48 3841 f548 ad0f 6d48  .w.H..mH8A.H..mH
000000a0: b092 f348 a10f 6d48 b092 c648 a90f 6d48  ...H..mH...H..mH
000000b0: a277 e948 aa0f 6d48 b092 f148 b50f 6d48  .w.H..mH...H..mH
000000c0: a277 fe48 be0f 6d48 ab0f 6c48 ca09 6d48  .w.H..mH..lH..mH
000000d0: b092 c748 a00e 6d48 b092 f748 aa0f 6d48  ...H..mH...H..mH
000000e0: ab0f fa48 aa0f 6d48 b092 f048 aa0f 6d48  ...H..mH...H..mH
000000f0: 5269 6368 ab0f 6d48 0000 0000 0000 0000  Rich..mH........
00000100: 0000 0000 0000 0000 5045 0000 4c01 0500  ........PE..L...
00000110: 83cd f251 0000 0000 0000 0000 e000 2201  ...Q..........".
00000120: 0b01 0a00 004c 1500 00da 1b00 0000 0000  .....L..........
00000130: 7a34 1500 0010 0000 0060 1500 0000 4000  z4.......`....@.

2.3 DOS部首

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

e_lfanew表示NT头的偏移
e_lfanew的偏移是60，而Whireshark.exe的60处的值为"08010000"=0x00000108（注：i386机器上整数存储是小端的）
也就是说NT头的文件偏移为0x108
注：可根据PE快速确定NT头位置

 

2.4 NT头

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

2.4.1 IMAGE_FILE_HEADER

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
#define IMAGE_SIZEOF_FILE_HEADER             20

2.4.2 IMAGE_OPTIONAL_HEADER

typedef struct _IMAGE_OPTIONAL_HEADER {
    //
    // Standard fields.
    //

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint;
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    //
    // NT additional fields.
    //

    DWORD   ImageBase;
    DWORD   SectionAlignment;
    DWORD   FileAlignment;
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

2.5 LinkerVersion偏移
由以上结构可以看出，相对NT头偏移为：
MajorLinkerVersion offset = sizoef(Signature) + sizeof(IMAGE_FILE_HEADER) + 2 = 4 + 20 + 2 = 26 = 0x1a
MinorLinkerVersion offset = 4 + 20 + 3 = 27 = 0x1b

相对EXE文件偏移为：
MajorLinkerVersion offset = offsetof(NT) + 0x1a = 0x108 + 0x1a = 0x122
MinorLinkerVersion offset = offsetof(NT) + 0x1b = 0x108 + 0x1b = 0x123

 

可以看出主副版本分别是10(0xa),0(0x00)

 

3 About Wireshark
可以从Help->About Wireshark菜单直接看到编译版本信息

 

 

不过看PE文件内的链接器主副版本号更通用，可以看出未提供编译相关信息软件所使用VC的版本号