程序员的自我修养: PE文件

最新推荐文章于 2025-01-18 08:50:04 发布

原创最新推荐文章于 2025-01-18 08:50:04 发布 · 724 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#image #header #struct #file #dos #数据结构

VC++ 同时被 2 个专栏收录

54 篇文章

订阅专栏

window编程

21 篇文章

订阅专栏

本文详细介绍了PE文件格式的内部结构，包括IMAGE_DOS_HEADER、IMAGE_NT_HEADERS等关键部分，并解释了IMAGE_DATA_DIRECTORY如何存储重要信息如导入表、导出表等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

_____________________________________

Image DOS Header IMAGE_DOS_HEADER

_____________________________________

Image DOS Stub

_____________________________________

PE File Header IMAGE_NT_HEADERS

______________________________

| Image Header IMAGE_FILE_HEADER |

|_____________________________ |

|Image Optional Header |

|IMAGE_OPTIONAL_HEADER32 |

|_____________________________|

_____________________________________

Section Table IMAGE_SECTION_HEADER[]

_____________________________________

.text

_____________________________________

.data

_____________________________________

.drectve

_____________________________________

.debug$S

_____________________________________

...

_____________________________________

Symbol Table

_____________________________________

typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER OptionalHeader; } IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;

typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics; } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; DWORD BaseOfData; DWORD ImageBase; DWORD SectionAlignment; DWORD FileAlignment; WORD MajorOperatingSystemVersion; WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; DWORD SizeOfHeaders; DWORD CheckSum; WORD Subsystem; WORD DllCharacteristics; DWORD SizeOfStackReserve; DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; IMAGE_DATA_DIRECTORY DataDirectory IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER;

在系统转载PE可执行文件时, 往往需要很快找到一些装载所需要的数据结构,如导入表,导出表,资源,重定位表等.

他们保存在IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];中.

typedef struct _IMAGE_DATA_DIRECTORY { DWORD VirtualAddress; DWORD Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16