pe结构（pe structure）

《pe结构（pe structure）》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、pe结构（PEstructure）PEstructurelearning1...DOSheader64bytesTypedefstruct_IMAGE_DOS_HEADER{WORDe_magic;//magicnumberASCIIcharacterMZ5A0x00000000-0x00000001mustbe4DWORDe_cblp;//0x00000002-0x00000003bytesoffilelastpageWORDe_cp;//0x00000004-0x00000005filepagesWORDe_c

2、rlc;//relocationnumberofelements0x00000006-0x00000007WORDe_cparhdr;//theparagraphasaunitheadsize0x00000008-0x00000009WORDe_minalloc;//theminimumrequiredadditional0x0000000A-0x0000000BWORDe_maxalloc;//themaximumrequiredadditional0x0000000C-0x0000000DWORDe_ss;//

3、initialstacksegment(SS)relativeoffsetvalue0x0000000E-0x0000000FWORDe_sp;//theinitialvalueofthestackpointer(SP)0x00000010-0x00000011WORDe_csum;//checksum0x00000012-0x00000013WORDe_ip;//theinitialvalueoftheinstructionpointer(IP)0x00000014-0x00000015WORDe_cs;//in

4、itialcodesegment(CS)relativeoffsetvalue0x00000016-0x00000017WORDe_lfarlc;//relocationtableinthefileoffsetaddress0x00000018-0x00000019WORDe_ovno0x0000001A-0x0000001B;//coverWORDe_res[4];//reservedwords(usuallyreservedtoensurethealignmentof0x0000001C-0x00000023)

5、WORDe_oemid;//OEMidentifier(relativetoe_oeminfo)0x00000024-0x00000025WORDe_oeminfo;//OEMinformation,namelythedetailsofe_oemid0x00000026-0x00000027WORDe_res2[10];//reservedwords(usuallyreservedtoensurethealignmentof0x00000028-0x0000003B)LONGe_lfanew;//exenewhea

6、dinthefileoffsetaddress0x0000003C-0x0000003F}IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER;2...DOSSTUB112bytes3...PEheadTypedefstruct_IMAGE_NT_HEADERS{DWORDSignature;//5045IMAGE_FILE_HEADERFileHeader;------------->IMAGE_OPTIONAL_HEADEROptionalHeader;--------------？}imag

7、e_nt_headerspimage_nt_headers，*，PeHeader；>----------------文件头（20字节）----------------------->_image_file_header{typedefstruct字机；//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

8、///////////////////////////////////////////////////////#定义image_file_machine_unknown0///#定义image_file_machine_i3860x014c/英特尔386。/////#定义image_file_machine_r30000x0162MIPS0x160大端小端，