浅谈PE文件结构（四）

撒旦姥爷的黑山羊คิดถึง

已于 2022-07-02 23:21:03 修改

阅读量1.6k

点赞数 1

CC 4.0 BY-SA版权

文章标签：系统安全

于 2022-07-02 23:16:33 首次发布

本文链接：https://blog.youkuaiyun.com/weixin_43137410/article/details/125579341

0x00 前言

前几文已经将PE文件的头文件讲述完毕，在PE文件中在头文件之后就是文件的数据文件，分别为区段表、.idata段、.text段、.data段等，本文将继续对其进行分析。

0x01 区段表

可以使用工具LordPE、IDA、PEditor等工具查看文件属性。
在这里插入图片描述

点击查看区段

在这里插入图片描述

.text：为代码段，偏移地址为0x1000，大小为0x1000字节。
.rdata：为只读数据段，偏移地址为0x2000，大小为0x1000字节。
.data：为数据段，偏移地址为0x3000，大小为0x1000字节。
.rsrc：为资源数据段，偏移地址为0x4000，大小为0x1000字节。

区段表记录了程序的区段划分、区段偏移地址及区段的大小。

0x02 区段头字段

每个区段的字段同样是一个结构体数据，具体字段如下：

typedef struct _IMAGE_SECTION_HEADER {
  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];
  union {
    DWORD PhysicalAddress;
    DWORD VirtualSize;
  } Misc;
  DWORD VirtualAddress;
  DWORD SizeOfRawData;
  DWORD PointerToRawData;
  DWORD PointerToRelocations;
  DWORD PointerToLinenumbers;
  WORD  NumberOfRelocations;
  WORD  NumberOfLinenumbers;
  DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

Name：一个8字节的空填充UTF-8字符串。如果字符串长度正好为8个字符，则不存在终止空字符。对于较长的名称，此字段包含正斜杠（/），后跟十进制数的ASCII表示形式，该十进制数是字符串表中的偏移量。可执行文件不使用字符串表，并且不支持长度超过8个字符的节名称。
Misc.PhysicalAddress：文件地址。
Misc.VirtualSize：加载到内存中时节的总大小，以字节为单位。如果该值大于SizeOfRawData成员，则该部分将填充零。此字段仅对可执行文件有效，对于对象文件应设置为0。
VirtualAddress：加载到内存中时段的第一个字节的地址，相对于文件基址。对于对象文件，这是应用重定位之前第一个字节的地址。
SizeOfRawData：磁盘上初始化数据的大小，以字节为单位。该值必须是IMAGE_OPTIONAL_HEADER结构体的FileAlignment成员的倍数。如果该值小于VirtualSize成员，则该部分的其余部分将填充零。如果节仅包含未初始化的数据，则成员为零。
PointerToRawData：指向COFF文件内第一页的文件指针。该值必须是IMAGE_OPTIONAL_HEADER结构体的FileAlignment成员的倍数。如果节仅包含未初始化的数据，请将此成员设置为零。
PointerToRelocations：指向节的重定位项开头的文件指针。如果没有重定位，则该值为零。
PointerToLinenumbers：指向节行号条目开头的文件指针。如果没有COFF行号，则该值为零。
NumberOfRelocations：节的重定位条目数。对于可执行文件，该值为零。
NumberOfLinenumbers：节的行号条目数。
Characteristics：文件的特征。定义了以下值：

Flag	Meaning
0x00000000	Reserved.
0x00000001	Reserved.
0x00000002	Reserved.
0x00000004	Reserved.
IMAGE_SCN_TYPE_NO_PAD 0x00000008	The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES.
0x00000010	Reserved.
IMAGE_SCN_CNT_CODE 0x00000020	The section contains executable code.
IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040	The section contains initialized data.
IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080	The section contains uninitialized data.
IMAGE_SCN_LNK_OTHER 0x00000100	Reserved.
IMAGE_SCN_LNK_INFO 0x00000200	The section contains comments or other information. This is valid only for object files.
0x00000400	Reserved.
IMAGE_SCN_LNK_REMOVE 0x00000800	The section will not become part of the image. This is valid only for object files.
IMAGE_SCN_LNK_COMDAT 0x00001000	The section contains COMDAT data. This is valid only for object files.
0x00002000	Reserved.
IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000	Reset speculative exceptions handling bits in the TLB entries for this section.
IMAGE_SCN_GPREL 0x00008000	The section contains data referenced through the global pointer.
0x00010000	Reserved.
IMAGE_SCN_MEM_PURGEABLE 0x00020000	Reserved.
IMAGE_SCN_MEM_LOCKED 0x00040000	Reserved.
IMAGE_SCN_MEM_PRELOAD 0x00080000	Reserved.
IMAGE_SCN_ALIGN_1BYTES 0x00100000	Align data on a 1-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_2BYTES 0x00200000	Align data on a 2-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_4BYTES 0x00300000	Align data on a 4-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_8BYTES 0x00400000	Align data on a 8-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_16BYTES 0x00500000	Align data on a 16-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_32BYTES 0x00600000	Align data on a 32-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_64BYTES 0x00700000	Align data on a 64-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_128BYTES 0x00800000	Align data on a 128-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_256BYTES 0x00900000	Align data on a 256-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_512BYTES 0x00A00000	Align data on a 512-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_1024BYTES 0x00B00000	Align data on a 1024-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_2048BYTES 0x00C00000	Align data on a 2048-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_4096BYTES 0x00D00000	Align data on a 4096-byte boundary. This is valid only for object files.
IMAGE_SCN_ALIGN_8192BYTES 0x00E00000	Align data on a 8192-byte boundary. This is valid only for object files.
IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000	The section contains extended relocations. The count of relocations for the section exceeds the 16 bits that is reserved for it in the section header. If the NumberOfRelocations field in the section header is 0xffff, the actual relocation count is stored in the VirtualAddress field of the first relocation. It is an error if IMAGE_SCN_LNK_NRELOC_OVFL is set and there are fewer than 0xffff relocations in the section.
IMAGE_SCN_MEM_DISCARDABLE 0x02000000	The section can be discarded as needed.
IMAGE_SCN_MEM_NOT_CACHED 0x04000000	The section cannot be cached.
IMAGE_SCN_MEM_NOT_PAGED 0x08000000	The section cannot be paged.
IMAGE_SCN_MEM_SHARED 0x10000000	The section can be shared in memory.
IMAGE_SCN_MEM_EXECUTE 0x20000000	The section can be executed as code.
IMAGE_SCN_MEM_READ 0x40000000	The section can be read.
IMAGE_SCN_MEM_WRITE 0x80000000	The section can be written to.

#按二进制位对照上表查询相关的特征属性即可。

0x03 .idata段

是一个特殊数据段，即快速调用表，导入函数的代码段，存放外部函数地址，结合demo文件查看。

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-wxGu7jdQ-1656774726409)(C:\Users\Thinkpad\AppData\Roaming\Typora\typora-user-images\image-20220702230403016.png)]