每个PE文件都以一个DOS程序开始.当PE文件在DOS下执行时,DOS可以识别出这是一个有效的执行体,然后运行DOS stub.
DOS MZ HEADER和DOS stub合称为DOS文件头
PE文件前0x40个字节是一个传统的MS-DOS头,结构为IMAGE_DOS_HEADER
winn.h中定义:
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
LONG e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
重要字段:
e_magic -> 为IMAGE_DOS_SIGNATURE(MZ)时,标识DOS头.
文件偏移: +0h
e_lfanew -> PE文件头的文件偏移(FOV),即文件偏移e_lfanew处为PE文件头的起始
文件偏移: +3ch
扫一扫
789
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
