PE文件格式

struct IMAGE_DOS_HEADER{
	WORD MZSignature,
	WORD UsedBytesInThrLastPage,
	WORD FileSizeInPages,
	WORD NumberOfRelocationItems,
	WORD HeaderSizeInParagraphs,
	WORD MinimumExtraParagraphs,
	WORD MaximumExtraParagraphs,
	WORD InitialRelativeSS,
	WORD InitialISP,
	WORD Checksum,
	WORD InitialIP,
	WORD InitialRelativeCS,
	WORD AddressOfRelocationTable,
	WORD OverlayNumber,
	WORD Reserved[4],
	WORD OEMid,
	WORD OEMinfo,
	WORD Reserved2[10],
	LONG AddressOfNewExeHeader
};
struct IMAGE_DOS_STUB DosStub{
	UCHAR Data[64];
	struct RICH_HEADER_ENTRY Entry[9]{
		struct RICH_HEADER_ENTRY Entry[0~8]{
		DWORD IdVersion;
		DWORD Count;
		};
		DWORD EndMarker;
		DWORD XorKey;
	};
};
struct IMAGE_NT_HEADERS NtHeader{
	DWORD Signature;
	struct IMAGE_FILE_HEADER FileHeader{
		enum IMAGE_MACHINE Machine;//machine_bits
		WORD NumberOfSections;
		time_t TimeDateStamp;
		DWORD PointerToSymbolTable;
		DWORD NumberOfSymnols;
		WORD SizeOfOptionalHeader;
		struct FILE_CHARATERISTICS Characteristics{
			WORD IMAGE_FILE_RELOCS_STRIPPED;
			WORD IMAGE_FILE_EXECUTABLE_IMAGE;
			WORD IMAGE_FILE_LINE_NUMS_STRIPPED;
			WORD IMAGE_FILE_LOCAL_SYMS_STRIPPED;
			WORD IMAGE_FILE_AGGRESIVE)WS_TRIM;
			WORD IMAGE_FILE_LARGE_ADDRESS_AWARE;
			WORD IMAGE_FILE_BYTES_REVERSED_LO;
			WORD IMAGE_FILE_32BIT_MACHINE;
			WORD IMAGE_FILE_DEBUG_STRIPPED;
			WORD IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP;
			WORD IMAGE_FILE_NET_RUN_FROM_SWAP;
			WORD IMAGE_FILE_SYSTEM;
			WORD IMAGE_FILE_DLL;
			WORD IMAGE_FILE_UP_SYSTEM_ONLY;
			WORD IMAGE_FILE_BYTES_REVERSED_HI;
		};
	};
	struct IMAGE_OPTIONAL_HEADER64 OptionalHeader{
		enum OPTIONAL_MAGIC Magic;//bits
		BYTE MajorLinkerVersion;
		BYTE MinorLinkerVersion;
		DWORD SizeOfInitializeData;
		DWORD SizeOfUninitializeData;
		DWORD AddressOfEntrypoint;
		DWORD BaseOfCode;
		ULONGLONG ImageBase;
		DWORD SectionAlignment;
		WORD FileAlignment;
		WORD MajoroperatingSystemVersion;
		WORD MinorOperatingSystemVersion;
		WORD MajorImageVersion;
		WORD MinorImageVersion;
		WORD MajorSubsystemVersion;
		WORD MinorSubsystemVersion;
		DWORD Win32VersionValue;
		DWORD SizeOfImage;
		DWORD SizeOfHeaders;
		DWORD CheckSum;
		enum IMAGE_SUBSYSTEM Subsystem;//care
		struct DLL_CHARACTERISTICS DllCharacteristics{
			ULONGLONG SizeOfStackReserve;
			ULONGLONG SizeOfStackCommit;
			ULONGLONG SizeOfHeapReserve;
			ULONGLONG SizeOfHeapCommit;
			DWORD LoadFlags;
			DWORD NumberOfRvaAndSizes;	
		};
		struct IMAGE_DATA_DIRECTORY_ARRAY DataDirArray{
			struct IMAGE_DATA_DIRECTORY Export{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY Import{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY Resource{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY Exception{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY Security{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY BaseRelocationTable{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY DebugDirectory{
				DWORD VirtualAddress;
				DWORD Size;
			};struct IMAGE_DATA_DIRECTORY CopyrightOrArchitectureSpecificData{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY GlobalPtr{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY TLSDirectory{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY LoadConfigurationDirectory{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY BoundImportDirectory{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY ImportAddressTable{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY DelayLoadImportDescriptors{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY COMRuntimedescriptors{
				DWORD VirtualAddress;
				DWORD Size;
			};
			struct IMAGE_DATA_DIRECTORY Reserved{
				DWORD VirtualAddress;
				DWORD Size;
			};
		};
	};
};
struct IMAGE_SECTION_HEADER SectionHeaders[1]{
	struct IMAGE_SECTION_HEADER SectionHeaders[0]{//.text;.data;.rsrc;.reloc
		BYTE Name[8];//.text
		union Misc{
			DWORD PhysicalAddress;
			DWORD VirtualSize;
		};
		DWORD VirtualAddress;
		DWORD SizeOfRawData;
		DWORD PointerRawData;
		DWORD PointerToRelocations;
		DWORD PointerToLinenumbers;
		WORD NumberOfRelocations;
		WORD NumberOfLinenumbers;
	};
	struct SECTION_CHARACTERISTIC Characteristics{
		ULONG IMAGE_SCN_TYPE_NO_PAD[1];
		ULONG IMAGE_SCN_CNT_CODE[1];
		ULONG IMAGE_SCN_CNT_INITIALZED_DATA[1];
		ULONG IMAGE_SCN_CNT_UNINITIALIZED_DATA[1];
		ULONG IMAGE_SCN_LNK_OTHER[1];
		ULONG IMAGE_SCN_LNK_INFO[1];
		ULONG IMAGE_SCN_LNK_REMOVE[1];
		ULONG IMAGE_SCN_LNK_COMDAT[1];
		ULONG IMAGE_SCN_GPREL[1];
		ULONG IMAGE_SCN_MEM_16BIT[1];
		ULONG IMAGE_SCN_MEM_LOCKED[1];
		ULONG IAMGE_SCN_MEM_RELOAD[1];
		ULONG IMAGE_SCN_ALIGN_1BYTES[1];
		ULONG IMAGE_SCN_ALIGN_2BYTES[1];
		ULONG IMAGE_SCN_ALIGN_8BYTES[1];
		ULONG IMAGE_SCN_ALIGN_128BYTES[1];
		ULONG IMAGE_SCN_LNK_NERLOC_OVFL[1];
		ULONG IMAGE_SCN_MEM_DISCARDABLE[1];
		ULONG IMAGE_SCN_MEM_NOT_CACHED[1];
		ULONG IMAGE_SCN_MEM_NOT_PAGED[1];
		ULONG IMAGE_SCN_MEM_SHARED[1];
		ULONG IMAGE_SCN_MEM_EXECUTE[1];
		ULONG IMAGE_SCN_MEM_READ[1];
		ULONG IMAGE_SCN_MEM_WRITE[1];
	};
};
struct IMAGE_SECTION_HEADER SetionHeaders[0]{
	UCHAR Data[2323224];
}
struct IMAGE_IMPORT_DESCRIPTOR ImportDescriptor[0]{
	union DUMMYUNIONAME{
		ULONG Charactertics;
		ULONG OriginalFirstThunk;
	};
	ULONG TimeDataStamp;
	ULONG ForwarderChain;
	ULONG Name;
	ULONG FirstThunk;
	struct IMAGE_IMPORT_BY_NAME ImportByName[0]{
		WPRD Hint;
		BYTE NAME[24];
	}
}
struct BASE_RELOCATION_TABLE RelocTable{
	struct IMAGE_BASE_RELOCATION BASEReloc[0]{
		DWORD VirtualAddress;
		DWORD SizeOfBlock;
	};
	WORD Block[86];
}

看不懂再看图解: