【加密与解密（第四版）】第十一章笔记-优快云博客

本文链接：https://blog.youkuaiyun.com/m0_58213960/article/details/139121017

第十一章 PE文件格式

这一章比较熟悉，但就是“易学难精”

PE文件衍生于早期建立在VAX/VMS上的COFF文件格式。

11.1-4 PE的基本概念、MS-DOS头部、PE文件头、区块

RVA=VA-ImageBsae

PNTHeader=ImageBase+dosHeader->e_lfanew

64位的IMAGE_NT_GEADER和32位的几乎没有区别

    typedef struct _IMAGE_DOS_HEADER {

      WORD e_magic;

      WORD e_cblp;

      WORD e_cp;

      WORD e_crlc;

      WORD e_cparhdr;

      WORD e_minalloc;

      WORD e_maxalloc;

      WORD e_ss;

      WORD e_sp;

      WORD e_csum;

      WORD e_ip;

      WORD e_cs;

      WORD e_lfarlc;

      WORD e_ovno;

      WORD e_res[4];

      WORD e_oemid;

      WORD e_oeminfo;

      WORD e_res2[10];

      LONG e_lfanew;

    } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER;



    typedef struct _IMAGE_NT_HEADERS64 {

      DWORD Signature;

      IMAGE_FILE_HEADER FileHeader;

      IMAGE_OPTIONAL_HEADER64 OptionalHeader;

    } IMAGE_NT_HEADERS64,*PIMAGE_NT_HEADERS64;

    typedef struct _IMAGE_NT_HEADERS {

      DWORD Signature;

      IMAGE_FILE_HEADER FileHeader;

      IMAGE_OPTIONAL_HEADER32 OptionalHeader;

    } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32;



    typedef struct _IMAGE_FILE_HEADER {

      WORD Machine;

      WORD NumberOfSections;

      DWORD TimeDateStamp;

      DWORD PointerToSymbolTable;

      DWORD NumberOfSymbols;

      WORD SizeOfOptionalHeader;

      WORD Characteristics;

    } IMAGE_FILE_HEADER,*PIMAGE_FILE_HEADER;


    typedef struct _IMAGE_OPTIONAL_HEADER {

      WORD Magic;

      BYTE MajorLinkerVersion;

      BYTE MinorLinkerVersion;

      DWORD SizeOfCode;

      DWORD SizeOfInitializedData;

      DWORD SizeOfUninitializedData;

      DWORD AddressOfEntryPoint;

      DWORD BaseOfCode;

      DWORD BaseOfData;

      DWORD ImageBase;

      DWORD SectionAlignment;

      DWORD FileAlignment;

      WORD MajorOperatingSystemVersion;

      WORD MinorOperatingSystemVersion;

      WORD MajorImageVersion;

      WORD MinorImageVersion;

      WORD MajorSubsystemVersion;

      WORD MinorSubsystemVersion;

      DWORD Win32VersionValue;

      DWORD SizeOfImage;

      DWORD SizeOfHeaders;

      DWORD CheckSum;

      WORD Subsystem;

      WORD DllCharacteristics;

      DWORD SizeOfStackReserve;

      DWORD SizeOfStackCommit;

      DWORD SizeOfHeapReserve;

      DWORD SizeOfHeapCommit;

      DWORD LoaderFlags;

      DWORD NumberOfRvaAndSizes;

      IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];

    } IMAGE_OPTIONAL_HEADER32,*PIMAGE_OPTIONAL_HEADER32;

区块表

  typedef struct _IMAGE_SECTION_HEADER {

      BYTE Name[IMAGE_SIZEOF_SHORT_NAME];

      union {

  DWORD PhysicalAddress;

  DWORD VirtualSize;

      } Misc;

      DWORD VirtualAddress;

      DWORD SizeOfRawData;

      DWORD PointerToRawData;

      DWORD PointerToRelocations;

      DWORD PointerToLinenumbers;

      WORD NumberOfRelocations;

      WORD NumberOfLinenumbers;

      DWORD Characteristics;

    } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER;