PE笔记之NT头PE文件头

typedef struct _IMAGE_FILE_HEADER {

 

     WORD    Machine;                         　 //014C-IMAGE_FILE_MACHINE_I386

 

     WORD    NumberOfSections;                 　 //PE节数量-0007个节

 

     DWORD   TimeDateStamp;                     //时间戳E72B4FA9

 

     DWORD   PointerToSymbolTable;              //指向符号表0000

 

     DWORD   NumberOfSymbols;                   //符号表数量0000

 

     WORD    SizeOfOptionalHeader;              //扩展PE头大小00E0

 

     WORD    Characteristics;                   //文件属性0102-IMAGE_FILE_32BIT_MACHINE|IMAGE_FILE_EXECUTABLE_IMAGE

 

} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

转载于:https://www.cnblogs.com/zheh/p/4013705.html