![转载——小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)](http://hi.csdn.net/attachment/201107/28/0_1311869688E33v.gif)
typedef struct _IMAGE_FILE_HEADER
{
+04h WORD Machine; // 运行平台
+06h WORD NumberOfSections; // 文件的区块数目
+08h DWORD TimeDateStamp; // 文件创建日期和时间
+0Ch DWORD PointerToSymbolTable; // 指向符号表(主要用于调试)
+10h DWORD NumberOfSymbols; // 符号表中符号个数(同上)
+14h WORD SizeOfOptionalHeader; // IMAGE_OPTIONAL_HEADER32 结构大小
+16h WORD Characteristics; // 文件属性 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
该结构如下图所示:
![转载——小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)](http://hi.csdn.net/attachment/201107/28/0_1311869883A2jN.gif)
下边,小甲鱼童鞋为大家详细解释各个成员的含义和用法:
Value | Meaning |
---|---|
| x86 |
| Intel Itanium |
| x64 |
The characteristics of the image. This member can be one or more ofthe following values.
Value | Meaning |
---|---|
| Relocation information wasstripped from the file. The file must be loaded at itspreferred baseaddress. Ifthe base address is not available, theloader reports an error. |
| The file is executable (there areno unresolved external references). |
| COFF line numbers were strippedfrom the file. |
| COFF symbol table entries werestripped from file. |
| Aggressively trim the workingset. This value is obsolete as of Windows 2000. |
| The application can handleaddresses larger than 2 GB. |
| The bytes of the word arereversed. This flag isobsolete. |
| The computer supports 32-bitwords. |
| Debugging information was removedand stored separately in another file. |
| If the image is on removablemedia, copy it to and runit from the swapfile. |
| If the image is on the network,copy it to and run itfrom the swapfile. |
| The image is a systemfile. |
| The image is a DLL file. While itis an executable file, itcannot be run directly. |
| The file should be run only on auniprocessor computer. |
| The bytes of the word arereversed. This flag isobsolete. |