PE文件结构(0x03)

最新推荐文章于 2022-07-11 07:36:00 发布

Corax_2ven

最新推荐文章于 2022-07-11 07:36:00 发布

阅读量291

点赞数

本文链接：https://blog.csdn.net/u012173720/article/details/82500495

版权

PE文件的NT映像头

IMAGE_NT_HEADERS STRUCT{
    +0H    DWORD                    //Signature
    +4H    IMAGE_FILE_HEADER        //FileHeader
    +18H   IMAGE_OPTIONAL_HEADER32  //OptionalHeader
}    IMAGE_NT_HEADER ENDS

开始的第一个成员是PE的标志，也就是PE..(50 45 00 00).

第二个成员是什么呢？是一个结构，大结构包含着的一个小结构 ,IMAGE_FILE_HEADER.

typedef struct _IMAGE_FILE_HEADER {
  WORD      Machine;                        //运行平台
  WORD      NumberOfSections;               //区块数
  DWORD     TimeDateStamp;                  //文件创建时间和日期
  DWORD     PointerToSymbolTable;           //指向符号表(用于调试)
  DWORD     NumberOfSymbols;                //符号表中符号的个数
  WORD      SizeOfOptionalHeader;           //IMAGE_OPTIONAL_HEADER32结构的大小
  WORD      Characteristics;                //文件属性
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

解释一下，在微软官方的文档中

Machine ----> IMAGE_FILE_MACHINE_XXXX

Value	Meaning
IMAGE_FILE_MACHINE_I386 0x014c	x86
IMAGE_FILE_MACHINE_IA64 0x0200	Intel Itanium
IMAGE_FILE_MACHINE_AMD64 0x8664	x64

Value

Meaning

IMAGE_FILE_MACHINE_I386

0x014c

x86

IMAGE_FILE_MACHINE_IA64

0x0200

Intel Itanium

IMAGE_FILE_MACHINE_AMD64

0x8664

x64

TimeDateStamp

这个记录了文件被创立的时间，这个值是自1970年1月1日以来，用格林尼治时间(GMT)计算的秒数，超级精准，是比文件系统的日期时间还要精准的时间指示器。

SizeOfOptionalHeader

这个是上上面的PE文件的NT映像头 的第三个结构的大小，却是记录在了这个结构中，对于32位pe文件来说，这个值通常是(00E0h)，但对于64位的pe32+文件来说，这个值一般是(00F0h).

Characteristics

记录的是文件属性，每个属性有固定的值

Value	Meaning
IMAGE_FILE_RELOCS_STRIPPED 0x0001	Relocation information was stripped from the file. The file must be loaded at its preferred base address. If the base address is not available, the loader reports an error.
IMAGE_FILE_EXECUTABLE_IMAGE 0x0002	The file is executable (there are no unresolved external references).
IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004	COFF line numbers were stripped from the file.
IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008	COFF symbol table entries were stripped from file.
IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010	Aggressively trim the working set. This value is obsolete.
IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020	The application can handle addresses larger than 2 GB.
IMAGE_FILE_BYTES_REVERSED_LO 0x0080	The bytes of the word are reversed. This flag is obsolete.
IMAGE_FILE_32BIT_MACHINE 0x0100	The computer supports 32-bit words.
IMAGE_FILE_DEBUG_STRIPPED 0x0200	Debugging information was removed and stored separately in another file.
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400	If the image is on removable media, copy it to and run it from the swap file.
IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800	If the image is on the network, copy it to and run it from the swap file.
IMAGE_FILE_SYSTEM 0x1000	The image is a system file.
IMAGE_FILE_DLL 0x2000	The image is a DLL file. While it is an executable file, it cannot be run directly.
IMAGE_FILE_UP_SYSTEM_ONLY 0x4000	The file should be run only on a uniprocessor computer.
IMAGE_FILE_BYTES_REVERSED_HI 0x8000	The bytes of the word are reversed. This flag is obsolete.