PE文件名目文档

副标题#e#

NT头—可选头—IMAGE_DATA_DIRECTORY—IMAGE_DIRECTORY_ENTRY_RESOURCE—>

IMAGE_SECTION_HEADER[](节头/表)

……

节n—->IMAGE_RESOURCE_DIRECTORY_ENTRY[]—IMAGE_RESOURCE_DIRECTORY[]

—————–0:DOS头

—————–1:NT头

typedef struct _IMAGE_NT_HEADERS {
DWORD Signature;//PE文件头符号 :"PE\0\0"。在开始DOS header的偏移3CH地方指向的地点开始
IMAGE_FILE_HEADER FileHeader; //PE文件物理漫衍的信息
IMAGE_OPTIONAL_HEADER32 OptionalHeader;//PE文件逻辑漫衍的信息
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

—————–1.1:文件头

typedef struct _IMAGE_FILE_HEADER {
WORD Machine; //该文件运行所需要的CPU，对付Intel平台是14Ch
WORD NumberOfSections; //文件的节数目
DWORD TimeDateStamp; //文件建设日期和时间
DWORD PointerToSymbolTable; //用于调试
DWORD NumberOfSymbols; //标记表中标记个数
WORD SizeOfOptionalHeader; //OptionalHeader 布局巨细
WORD Characteristics; //文件信息标志，区分文件是exe照旧dll
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

—————–1.2:可选头

typedef struct _IMAGE_OPTIONAL_HEADER {
WORD Magic; //符号字(老是010bh)
BYTE MajorLinkerVersion; //毗连器版本号
BYTE MinorLinkerVersion; //
DWORD SizeOfCode; //代码段巨细
DWORD SizeOfInitializedData; //已初始化数据块巨细
DWORD SizeOfUninitializedData;//未初始化数据块巨细
DWORD AddressOfEntryPoint; //PE装载器筹备运行的PE文件的第一个指令的RVA，若要改变整个执行的流程，可以将该值指定到新的RVA，这样新RVA处的指令首先被执行。（很多文章都有先容RVA，请去相识）
DWORD BaseOfCode; //代码段起始RVA
DWORD BaseOfData; //数据段起始RVA
DWORD ImageBase; //PE文件的装载地点
DWORD SectionAlignment; //块对齐
DWORD FileAlignment; //文件块对齐
WORD MajorOperatingSystemVersion;//所需操纵系统版本号
WORD MinorOperatingSystemVersion;//
WORD MajorImageVersion; //用户自界说版本号
WORD MinorImageVersion; //
WORD MajorSubsystemVersion; //win32子系统版本。若PE文件是专门为Win32设计的
WORD MinorSubsystemVersion; //该子系统版本肯定是4.0不然对话框不会有3维立体感
DWORD Win32VersionValue; //保存
DWORD SizeOfImage; //内存中整个PE映像体的尺寸
DWORD SizeOfHeaders; //所有头+节表的巨细
DWORD CheckSum; //校验和
WORD Subsystem; //NT用来识别PE文件属于哪个子系统
WORD DllCharacteristics; //
DWORD SizeOfStackReserve; //
DWORD SizeOfStackCommit; //
DWORD SizeOfHeapReserve; //
DWORD SizeOfHeapCommit; //
DWORD LoaderFlags; //
DWORD NumberOfRvaAndSizes; //
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];//=16
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

#p#副标题#e#

—————–1.2.1:数据目次？

typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress; //表的RVA地点
DWORD Size; //巨细
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

—————–1.2.2数据进口

// Directory Entries
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor

—————–1.2.2.0导出函数表？

#p#副标题#e#

typedef struct _IMAGE_EXPORT_DIRECTORY {
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
DWORD Name;
DWORD Base;
DWORD NumberOfFunctions;
DWORD NumberOfNames;
DWORD AddressOfFunctions; // RVA from base of image
DWORD AddressOfNames; // RVA from base of image
DWORD AddressOfNameOrdinals; // RVA from base of image
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

—————–1.2.2.1引入函数表

—————–1.2.2.2资源表

—————–1.2.2.3异常表？

—————–1.2.2.4安详表？

—————–1.2.2.5重定向表

—————–1.2.2.6调试信息表

……

—————–2:节表(段表)

#p#分页标题#e#

typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];//节表名称,如“.text”
union {
DWORD PhysicalAddress; //物理地点
DWORD VirtualSize; //真实长度
} Misc;
DWORD VirtualAddress; //RVA
DWORD SizeOfRawData; //物理长度
DWORD PointerToRawData; //节基于文件的偏移量
DWORD PointerToRelocations; //重定位的偏移
DWORD PointerToLinenumbers; //行号表的偏移
WORD NumberOfRelocations; //重定位项数目
WORD NumberOfLinenumbers; //行号表的数目
DWORD Characteristics; //节属性
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

—————–3:节……

—————–3.1资源目次(_IMAGE_RESOURCE_DIRECTORY)

#p#副标题#e#

typedef struct _IMAGE_RESOURCE_DIRECTORY {
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
WORD NumberOfNamedEntries;
WORD NumberOfIdEntries;
// IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[];
} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;

—————-3.2资源目次进口(_IMAGE_RESOURCE_DIRECTORY_ENTRY)

typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
union {
struct {
DWORD NameOffset:31;
DWORD NameIsString:1;
};
DWORD Name;
WORD Id;
};
union {
DWORD OffsetToData;
struct {
DWORD OffsetToDirectory:31;
DWORD DataIsDirectory:1;
};
};
} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;

—————–3.211资源目次名

typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
WORD Length;
CHAR NameString[ 1 ];
} IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;

—————–3.212资源目次Unicode名

typedef struct _IMAGE_RESOURCE_DIR_STRING_U {
WORD Length;
WCHAR NameString[ 1 ];
} IMAGE_RESOURCE_DIR_STRING_U, *PIMAGE_RESOURCE_DIR_STRING_U;

—————–3.22资源数据进口

typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
DWORD OffsetToData;//偏移地点。并非在文件中的偏移!
DWORD Size; //巨细
DWORD CodePage;
DWORD Reserved;
} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;

—————–9:其他

假如是在资源根目次，id为:

1: cursor

2: bitmap

3: icon

4: menu

5: dialog

6: string table

7: font directory

8: font

9: accelerators

10: unformatted resource data

11: message table

12: group cursor

14: group icon

16: version information