使用Windbg认识Ｗindows PE结构

最新推荐文章于 2023-04-13 16:27:32 发布

原创最新推荐文章于 2023-04-13 16:27:32 发布 · 381 阅读

1 ·

CC 4.0 BY-SA版权

PE 专栏收录该内容

6 篇文章

订阅专栏

本文详细解析了Notepad++的内存布局，包括模块名称、地址范围、文件类型、机器类型、时间日期戳、入口点地址、代码大小、初始化数据大小、资源目录地址等关键信息。通过分析可了解其加载过程及依赖的外部库。

0:000> lm

start    end        module name
00590000 005c0000   notepad    (deferred)             
0f2f0000 0f2f8000   DAVHLPR    (deferred)             
3f380000 3f389000   VERSION    (deferred)             
6cea0000 6cef1000   WINSPOOL   (deferred)             
73900000 73b0f000   COMCTL32   (deferred)             
744e0000 744ea000   CRYPTBASE   (deferred)             
744f0000 7450e000   SspiCli    (deferred)             
74510000 7465e000   GDI32      (deferred)             
74660000 746b8000   bcryptPrimitives   (deferred)

0:000> !dh -f notepad

File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
     14C machine (i386)
       4 number of sections
559EA6FF time date stamp Fri Jul 10 00:53:19 2015

       0 file pointer to symbol table
       0 number of symbols
      E0 size of optional header
     102 characteristics
            Executable
            32 bit word machine

OPTIONAL HEADER VALUES
     10B magic #
    9.00 linker version
    A800 size of code
   22400 size of initialized data
       0 size of uninitialized data
    31C9 address of entry point
    1000 base of code
         ----- new -----
**00400000 image base**
    1000 section alignment
     200 file alignment
       2 subsystem (Windows GUI)
    6.01 operating system version
    6.01 image version
    6.01 subsystem version
   30000 size of image
     400 size of headers
   385B1 checksum
00040000 size of stack reserve
00011000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
    8140  DLL characteristics
            Dynamic base
            NX compatible
            Terminal server aware
       0 [       0] address [size] of Export Directory
    A0A0 [     12C] address [size] of Import Directory
    F000 [   1F168] address [size] of Resource Directory
       0 [       0] address [size] of Exception Directory
       0 [       0] address [size] of Security Directory
   2F000 [     E38] address [size] of Base Relocation Directory
    B69C [      38] address [size] of Debug Directory
       0 [       0] address [size] of Description Directory
       0 [       0] address [size] of Special Directory
       0 [       0] address [size] of Thread Storage Directory
    6D78 [      40] address [size] of Load Configuration Directory
     270 [     128] address [size] of Bound Import Directory
    1000 [     404] address [size] of Import Address Table Directory
       0 [       0] address [size] of Delay Import Directory
       0 [       0] address [size] of COR20 Header Directory
       0 [       0] address [size] of Reserved Directory

0:000> dt -n (_IMAGE_DOS_HEADER)00400000

ntdll!_IMAGE_DOS_HEADER
   +0x000 e_magic          : 0x5a4d
   +0x002 e_cblp           : 0x90
   +0x004 e_cp             : 3
   +0x006 e_crlc           : 0
   +0x008 e_cparhdr        : 4
   +0x00a e_minalloc       : 0
   +0x00c e_maxalloc       : 0xffff
   +0x00e e_ss             : 0
   +0x010 e_sp             : 0xb8
   +0x012 e_csum           : 0
   +0x014 e_ip             : 0
   +0x016 e_cs             : 0
   +0x018 e_lfarlc         : 0x40
   +0x01a e_ovno           : 0
   +0x01c e_res            : [4] 0
   +0x024 e_oemid          : 0
   +0x026 e_oeminfo        : 0
   +0x028 e_res2           : [10] 0
   +0x03c e_lfanew         : 0n216

0:000> dt -n (_IMAGE_NT_HEADERS)00400000+0n216

ntdll!_IMAGE_NT_HEADERS
   +0x000 Signature        : 0x4550
   +0x004 FileHeader       : _IMAGE_FILE_HEADER
   +0x018 OptionalHeader   : _IMAGE_OPTIONAL_HEADER
0:000> dx -r1 (*((ntdll!_IMAGE_FILE_HEADER *)0x4000dc))
(*((ntdll!_IMAGE_FILE_HEADER *)0x4000dc))                 [Type: _IMAGE_FILE_HEADER]
    [+0x000] Machine          : 0x14c [Type: unsigned short]
    [+0x002] NumberOfSections : 0x4 [Type: unsigned short]
    [+0x004] TimeDateStamp    : 0x559ea6ff [Type: unsigned long]
    [+0x008] PointerToSymbolTable : 0x0 [Type: unsigned long]
    [+0x00c] NumberOfSymbols  : 0x0 [Type: unsigned long]
    [+0x010] SizeOfOptionalHeader : 0xe0 [Type: unsigned short]
    [+0x012] Characteristics  : 0x102 [Type: unsigned short]

*0:000> dx -r1 (*((ntdll!_IMAGE_OPTIONAL_HEADER )0x4000f0))

(*((ntdll!_IMAGE_OPTIONAL_HEADER *)0x4000f0))                 [Type: _IMAGE_OPTIONAL_HEADER]
    [+0x000] Magic            : 0x10b [Type: unsigned short]
    [+0x002] MajorLinkerVersion : 0x9 [Type: unsigned char]
    [+0x003] MinorLinkerVersion : 0x0 [Type: unsigned char]
    [+0x004] SizeOfCode       : 0xa800 [Type: unsigned long]
    [+0x008] SizeOfInitializedData : 0x22400 [Type: unsigned long]
    [+0x00c] SizeOfUninitializedData : 0x0 [Type: unsigned long]
    [+0x010] AddressOfEntryPoint : 0x31c9 [Type: unsigned long]
    [+0x014] BaseOfCode       : 0x1000 [Type: unsigned long]
    [+0x018] BaseOfData       : 0xc000 [Type: unsigned long]
    [+0x01c] ImageBase        : 0x400000 [Type: unsigned long]
    [+0x020] SectionAlignment : 0x1000 [Type: unsigned long]
    [+0x024] FileAlignment    : 0x200 [Type: unsigned long]
    [+0x028] MajorOperatingSystemVersion : 0x6 [Type: unsigned short]
    [+0x02a] MinorOperatingSystemVersion : 0x1 [Type: unsigned short]
    [+0x02c] MajorImageVersion : 0x6 [Type: unsigned short]
    [+0x02e] MinorImageVersion : 0x1 [Type: unsigned short]
    [+0x030] MajorSubsystemVersion : 0x6 [Type: unsigned short]
    [+0x032] MinorSubsystemVersion : 0x1 [Type: unsigned short]
    [+0x034] Win32VersionValue : 0x0 [Type: unsigned long]
    [+0x038] SizeOfImage      : 0x30000 [Type: unsigned long]
    [+0x03c] SizeOfHeaders    : 0x400 [Type: unsigned long]
    [+0x040] CheckSum         : 0x385b1 [Type: unsigned long]
    [+0x044] Subsystem        : 0x2 [Type: unsigned short]
    [+0x046] DllCharacteristics : 0x8140 [Type: unsigned short]
    [+0x048] SizeOfStackReserve : 0x40000 [Type: unsigned long]
    [+0x04c] SizeOfStackCommit : 0x11000 [Type: unsigned long]
    [+0x050] SizeOfHeapReserve : 0x100000 [Type: unsigned long]
    [+0x054] SizeOfHeapCommit : 0x1000 [Type: unsigned long]
    [+0x058] LoaderFlags      : 0x0 [Type: unsigned long]
    [+0x05c] NumberOfRvaAndSizes : 0x10 [Type: unsigned long]
    [+0x060] DataDirectory    [Type: _IMAGE_DATA_DIRECTORY [16]]

0:000> dx -r2 (((ntdll!_IMAGE_DATA_DIRECTORY ()[16])0x400150))

(*((ntdll!_IMAGE_DATA_DIRECTORY (*)[16])0x400150))                 [Type: _IMAGE_DATA_DIRECTORY [16]]
    [0]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [1]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0xa0a0 [Type: unsigned long]
        [+0x004] Size             : 0x12c [Type: unsigned long]
    [2]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0xf000 [Type: unsigned long]
        [+0x004] Size             : 0x1f168 [Type: unsigned long]
    [3]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [4]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [5]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x2f000 [Type: unsigned long]
        [+0x004] Size             : 0xe38 [Type: unsigned long]
    [6]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0xb69c [Type: unsigned long]
        [+0x004] Size             : 0x38 [Type: unsigned long]
    [7]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [8]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [9]              [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [10]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x6d78 [Type: unsigned long]
        [+0x004] Size             : 0x40 [Type: unsigned long]
    [11]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x270 [Type: unsigned long]
        [+0x004] Size             : 0x128 [Type: unsigned long]
    [12]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x1000 [Type: unsigned long]
        [+0x004] Size             : 0x404 [Type: unsigned long]
    [13]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [14]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]
    [15]             [Type: _IMAGE_DATA_DIRECTORY]
        [+0x000] VirtualAddress   : 0x0 [Type: unsigned long]
        [+0x004] Size             : 0x0 [Type: unsigned long]