WIN 下的PE 和LINUX下的ELF 有很多相似之处,本是同根生,应该说都是起源于COFF,该格
式最早由DEC公司开发。在LINUX下可以用objdump工具(或readelf)进行查看,在WIN下可以
dumpbin工具进行查看。
在WIN下生成的EXE文件是PE格式的,但OBJ文件还是COFF格式的,这一点我们可以证实,随便
找个OBJ文件,我们用dumpbin来看一下:
Setting environment for using Microsoft Visual Studio 2005 x86 tools.
D:/Program Files/Microsoft Visual Studio 8/VC>f:
F:/>cd F:/1/Debug
F:/1/Debug>dumpbin /all 1.obj>c:/t.txt
t.txt开始部分文件内容如下,请看:
Microsoft (R) COFF/PE Dumper Version 8.00.50727.762
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file 1.obj
File Type: COFF OBJECT
FILE HEADER VALUES
14C machine (x86)
8A number of sections
4A28AED4 time date stamp Fri Jun 05 13:36:20 2009
C05C file pointer to symbol table
250 number of symbols
0 size of optional header
0 characteristics
SECTION HEADER #1
.drectve name
0 physical address
0 virtual address
2C8 size of raw data
15A4 file pointer to raw data (000015A4 to 0000186B)
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
100A00 flags
Info
Remove
1 byte align
我们可以看到File Type 是COFF格式的。
其中FILE HEADER VALUES 对应WinNT.h头文件中定义的结构体:
typedef struct _IMAGE_FILE_HEADER {
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;