PE文件学习之一 文件内容的分部

对于PE文件格式的学习，暂且只看文件格式，用WinHex来看看这个文件，看看用到的数据结构，看看文件内容的分部：

PE文件的分部大致如下图所示：

1.DOS头（IMAGE_DOS_HEADER）

2.NT头（IMAGE_NT_HEADERS32 ，IMAGE_FILE_HEADER，IMAGE_OPTIONAL_HEADER32）

3.区段头（IMAGE_SECTION_HEADER）

4.各个区段对应的内容

5.完

 

大致的意识就是说 ，对于一个PE文件，首先是DOS头，其次是NT头，NT头包含了文件头和可选头，再就是区段头，区段头的个数由NT头决定，区段头一个接一个的紧挨着分部，再就是每一个区段头对应的内容，也是一个接一个的，其分部的顺序按照区段头的顺序。

 

以下使用WinHex来观摩一个PE文件，此文件名叫MyUnpack.exe ，其主要功能是弹出一个MessageBox。

1.DOS头

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00   MZ............
00000010   B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ?......@.......
00000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000030   00 00 00 00 00 00 00 00  00 00 00 00 E0 00 00 00   ............?..

以下是DOS程序，在WINDOWS系统基本不会用到

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000040   0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68   ..?.???L?Th
00000050   69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F   is program canno
00000060   74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20   t be run in DOS 
00000070   6D 6F 64 65 2E 0D 0D 0A  24 00 00 00 00 00 00 00   mode....$.......
00000080   41 24 D0 16 05 45 BE 45  05 45 BE 45 05 45 BE 45   A$?.E綞.E綞.E綞
00000090   33 63 B5 45 04 45 BE 45  33 63 B4 45 1F 45 BE 45   3c礒.E綞3c碋.E綞
000000A0   86 59 B0 45 09 45 BE 45  05 45 BF 45 2D 45 BE 45   哬癊.E綞.E縀-E綞
000000B0   67 5A AD 45 00 45 BE 45  ED 5A B5 45 07 45 BE 45   gZ璄.E綞鞿礒.E綞
000000C0   52 69 63 68 05 45 BE 45  00 00 00 00 00 00 00 00   Rich.E綞........
000000D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

2.NT头

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000000E0   50 45 00 00 4C 01 03 00  A5 34 5D 50 00 00 00 00   PE..L...?]P....
000000F0   00 00 00 00 E0 00 0F 01  0B 01 06 00 00 40 00 00   ....?.......@..
00000100   00 40 00 00 00 00 00 00  20 10 00 00 00 10 00 00   .@...... .......
00000110   00 50 00 00 00 00 40 00  00 10 00 00 00 10 00 00   .P....@.........
00000120   04 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00   ................
00000130   00 90 00 00 00 10 00 00  00 00 00 00 02 00 00 00   ................
00000140   00 00 10 00 00 10 00 00  00 00 10 00 00 10 00 00   ................
00000150   00 00 00 00 10 00 00 00  00 00 00 00 00 00 00 00   ................
00000160   3C 54 00 00 3C 00 00 00  00 00 00 00 00 00 00 00   <T..<...........
00000170   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000180   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000190   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000001A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000001B0   00 00 00 00 00 00 00 00  00 50 00 00 A4 00 00 00   .........P..?..
000001C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000001D0   00 00 00 00 00 00 00 00                            ........

3.区段头

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000001D0                            2E 74 65 78 74 00 00 00           .text...
000001E0   CE 35 00 00 00 10 00 00  00 40 00 00 00 10 00 00   ?.......@......
000001F0   00 00 00 00 00 00 00 00  00 00 00 00 20 00 00 60   ............ ..`
00000200   2E 72 64 61 74 61 00 00  DE 07 00 00 00 50 00 00   .rdata..?...P..
00000210   00 10 00 00 00 50 00 00  00 00 00 00 00 00 00 00   .....P..........
00000220   00 00 00 00 40 00 00 40  2E 64 61 74 61 00 00 00   ....@..@.data...
00000230   FC 29 00 00 00 60 00 00  00 30 00 00 00 60 00 00   ?...`...0...`..
00000240   00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 C0   ............@..?

4.区段头所对应的内容，一一对应的关系，在本例中，就是其排布顺序如下：

.text段的内容

.rdata段的内容

.data段的内容

限于篇幅，我就不复制过来了，自己可以看，关于区段中很多内容为0，是因为必须按照文件对齐，所以不足的地方要填0

 

总结：到这里，我们对PE文件的数据分部有了一定的了解和认识，对每一块的数据我们都大致清楚是干嘛的了。