PE结构图

最新推荐文章于 2020-12-11 14:50:56 发布

lifeofcs001

最新推荐文章于 2020-12-11 14:50:56 发布

阅读量636

点赞数

分类专栏： PE

本文链接：https://blog.csdn.net/lifeofcs001/article/details/46797365

版权

PE 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic; //EXE标志,"MZ"
    WORD   e_cblp;
    WORD   e_cp;
    WORD   e_crlc;
    WORD   e_cparhdr;
    WORD   e_minalloc;
    WORD   e_maxalloc;
    WORD   e_ss;
    WORD   e_sp;
    WORD   e_csum;
    WORD   e_ip;
    WORD   e_cs;
    WORD   e_lfarlc;
    WORD   e_ovno;
    WORD   e_res[4];
    WORD   e_oemid;
    WORD   e_oeminfo;
    WORD   e_res2[10];
    LONG   e_lfanew;                    //RVA:IMAGE_NT_HEADER首地址
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature; //PE签名,"PE"
    IMAGE_FILE_HEADER FileHeader; //标准头
    IMAGE_OPTIONAL_HEADER32 OptionalHeader; //扩展头
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine; //运行平台
    WORD    NumberOfSections; //节区的数量
    DWORD   TimeDateStamp; //创建时间
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader; //扩展头尺寸
    WORD    Characteristics; //文件属性
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

typedef struct _IMAGE_OPTIONAL_HEADER {

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode; //所有含代码的节区的总大小
    DWORD   SizeOfInitializedData; //所有含初始化数据的节区的总大小
    DWORD   SizeOfUninitializedData; //所有含未初始化数据的节区的总大小
    DWORD   AddressOfEntryPoint; //RVA:程序的执行入口,就是第一个代码的地址
    DWORD   BaseOfCode; //RVA:代码节区的起始地址
    DWORD   BaseOfData; //RVA:数据节区的起始地址

    DWORD   ImageBase; //RV:程序的建议装载地址
    DWORD   SectionAlignment; //内存中节的对齐单位,一般为1000h
    DWORD   FileAlignment; //文件中节的对齐单位,一般为200h
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage; //内存中整个PE映像的尺寸
    DWORD   SizeOfHeaders; //除节区外PE映像的尺寸,这个尺寸在内存中和在文件中是一样大小
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes; //下面数据目录结构的数量
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; //数据目录
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress; //RVA:数据的起始地址
DWORD Size; //数据块的尺寸
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

#define IMAGE_SIZEOF_SHORT_NAME 8

typedef struct _IMAGE_SECTION_HEADER {
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME]; //节区的名字,共8个字节
    union {
            DWORD   PhysicalAddress;
            DWORD   VirtualSize; //节区的尺寸
    } Misc;
    DWORD   VirtualAddress; //RVA:节区的起始地址
    DWORD   SizeOfRawData; //文件中节区的尺寸
    DWORD   PointerToRawData; //RFA:文件中节区的地址
    DWORD   PointerToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics; //节区的属性
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;