写PE的一些过程
-----------------------------------------------------------------------------------------------LoardPE，C32-----------------------------------------------------------------------------------------------
Invalid keyboard code specified
0AE3:0000 4D 5A 00 00 00 00 00 00-00 00 00 00 00 00 00 00 MZ..............
0AE3:0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0030 00 00 00 00 00 00 00 00-00 00 00 00 B8 00 00 00 ................e_lfanew:指向PE头
0AE3:0040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0080 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0090 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:00A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:00B0 00 00 00 00 00 00 00 00-50 45 00 00 4C 01 03 00 ........PE..L.
Signature（PE标志）,Machine（运行平台，对于i386是014C）,NumberOfSections（区块的数目）
0AE3:00C0 00 00 00 00 00 00 00 00-00 00 00 00 E0 00 02 00 ................
SizeOfOptionalHeader（OptionalHeader的大小，一般32位的为00E0，64位的为00F0）,
Characteristics（文件属性，0002：文件可执行，2000：DLL文件）
0AE3:00D0 0B 01 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Magic（魔术字，一般为010B）,
SizeOfCode（代码区块的总大小，一般只有.text段，所以这儿可以是Code段的文件对齐后的大小）
0AE3:00E0 00 10 00 00 00 00 00 00-00 00 00 00 00 00 40 00 ..............@.
AddressOfEntryPoint（执行入口RVA，一般是.text段首）,
BaseOfCode（代码块起始RVA，一般为1000，但是链接器不同而改变）,
BaseOfDate（数据块起始RVA，这个值不一定，要看其他区块的个数以及链接器）,
ImageBase（程序加载进内存的基地址，一般为00400000）
0AE3:00F0 00 10 00 00 00 02 00 00-00 00 00 00 00 00 00 00 ................
SectionalAlignment（内存对齐值，一般为1000）,
FileAlignment（文件对齐值，一般为200）这两个对齐值可以自定义，
但是内存对齐值必须大于或者等于文件对齐值，当内存对齐值小于系统的页大小的时候，
内存对齐值必须等于文件对齐值。
0AE3:0100 04 00 00 00 00 00 00 00-04 30 00 00 00 04 00 00.........0......
MajorSubSystemVersion（子系统版本号，一般为0004）,
Win32VersionValue（子系统版本值，必须置为0，更改的话可能出现初始化失败错误）
SizeOfImage（文件装入内存后的总的大小，是对齐后的大小哈）,
SizeOfHeaders（PE文件头部（包括MZ-DOS，PE头，区块表）在文件对齐后的大小，
一般的大小为220h（544BYTE）对齐后的值400h，所以节的内容在文件中是从偏移400后开始的）
0AE3:0110 00 00 00 00 02 00 00 00-00 00 00 00 00 00 00 00 ................
CheckSum（文件的校验和）,
SubSystem（标明可执行文件期望的子系统，0002代表图形接口）
0AE3:0120 00 00 00 00 00 00 00 00-00 00 00 00 10 00 00 00 ................
NumberOfRvaAndSize（数据目录表的项数，值在2～16之间）
DataDirectory数组中每个元素占8个字节，4字节的VirtualAddress，4自己的Size
============数据目录表==============
0AE3:0130 00 00 00 00 00 00 00 00-08 20 00 00 28 00 00 00 ......... ..(...
Export Table（导出表：.edata）,Import Table（导入表:.rdata）(VirtualAddress,Size)
0AE3:0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Resources Table（异常表:.pdata）,Exception Table（资源表:.rsrc）
0AE3:0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Security Table(属性证书，类似于PE文件的校验和或者MD5值),Base relocation Table（重定位表:.reloc）
0AE3:0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Debug(调试数据所处在的节:.debug),Copyright
0AE3:0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Global Ptr,Thread local storage
0AE3:0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Load configuration(线程本地储存数据所处的节:.tls),Bound Import
0AE3:0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
Import Address Table,Delay Import
0AE3:01A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
COM descriptor,保留
每个IMAGE_SECTION_HEADER占40字节，有多少写多少
==========区块表开始，每个40字节========
0AE3:01B0 （2E 4C 65 72 6F 79 31 00）-(16 00 00 00 )(00 10 00 00) .Leroy1.........
（name）:区块名，8字节,
(VirtualSize):实际的区块的大小，没有被对齐前的值,
(VirtualAddress):这个区块载入内存后的RVA，一般：.text为1000，.rdata为2000，.data为3000
0AE3:01C0 (00 02 00 00 )(00 04 00 00)-00 00 00 00 00 00 00 00 ................
(SizeOfRawData):在文件里对齐后的尺寸,
(PointerToRawData):文件偏移
0AE3:01D0 00 00 00 00 (20 00 00 60)-(2E 4C 65 72 6F 79 32 00) .... ..`.Leroy2.
(Characteristics):区块属性，一般：.text为60000020,.rdata为40000040,.data为C0000040,
（name）：下一个区块的区块名
0AE3:01E0 (52 00 00 00)( 00 20 00 00)-(00 02 00 00)( 00 06 00 00) R.... ..........
(VirtualSize),(VirtualAddress),(SizeOfRawData),(PointerToRawData)
0AE3:01F0 00 00 00 00 00 00 00 00-00 00 00 00 (40 00 00 40) ............@..@
(Characteristics)
0AE3:0200 (2E 4C 65 72 6F 79 33 00)-(04 0C 00 00)( 00 30 00 00) .Leroy3......0..
（name）,(VirtualSize),(VirtualAddress)
0AE3:0210 (00 02 00 00)( 00 08 00 00)-00 00 00 00 00 00 00 00 ................
(SizeOfRawData),(PointerToRawData)
0AE3:0220 00 00 00 00 (40 00 00 C0)-00 00 00 00 00 00 00 00 ....@...........
(Characteristics)
===========区块对齐，填充的00=========
0AE3:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0300 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0310 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0320 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0330 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0340 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0350 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0360 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0370 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0380 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0390 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:03F0 00 00 00 00 00 00 00 00-00 00 50 45 54 65 6E 64 ..........PETend（PE头部结束）
-----------------------------.text------------------------------------------------
0AE3:0400 B8 00 30 40 00 6A 00 50-50 6A 00 FF 15 00 20 40 ..0@.j.PPj.... @
0AE3:0410 00 33 C0 C2 10 00 00 00-00 00 00 00 00 00 00 00 .3..............
mov eax,00403000;push 0x0;push eax;push eax;push 0x0;call dword ptr ds:;
xor eax,eax;retn 0x10
0AE3:0420 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0430 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0440 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0450 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0460 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0470 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0480 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0490 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:04F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0500 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0510 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0520 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0530 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0540 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0550 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0560 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0570 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0580 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0590 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:05F0 00 00 00 00 00 00 00 00-00 00 00 00 00 65 6E 64 .............end(代码段结束)
--------------------------.rdata-----------------------------------------------------------
0AE3:0600 38 20 00 00 00 00 00 00-(30 20 00 00) 00 00 00 00 8 ......0 ......
IAT表：FirstThunk指到这里，其实是一个IMAGE_THUNK_DATA数组：这里的值8字节为一个单位，
当载入内存的时候，这里的值会根据OriginalFirstThunk指向的同一个函数名，变成所调用的API在
内存里的RVA。没被载入内存的时候，这里存的是指向函数名称的文件偏移，和OriginalFirstThunk
指向的地方一致。
(OriginalFirstThunk)：指向INT表，其实这里离.rdata段开头的地方还有一段距离，为什么要留出前面的
空间呢？其实这前面的空间到时候会装IAT表。
0AE3:0610 00 00 00 00 (46 20 00 00)-(00 20 00 00) 00 00 00 00 ....F ... ......
(Name)：动态链接库名称,(FirstThunk)：指向IAT表
0AE3:0620 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0630 38 20 00 00 00 00 00 00-(00 00 4D 65 73 73 61 67 8 ........Messag
INT表：OriginalFirstThunk指到这里，其实也是一个IMAGE_THUNK_DATA数组：
这里也是8字节一个单位，装的是调用的API函数的名字。这里和上面的IAT表在手写PE时都先预留，
预留大小的计算：4×导入函数的个数 + 4×Dll的个数。在IAT里，DLL之间用4字节分开，所以就该这么多了赛。
在INT表后面，紧接着是函数名称表，Hint：此函数在它所在的DLL里的序数，最后是函数名称，
同一个DLL里面的函数写完以后，就写这个DLL的名称。
0AE3:0640 65 42 6F 78 41 00)( 55 73-65 72 33 32 2E 64 6C 6C) eBoxA.User32.dll
(函数名称：MessageBox)，(Dll名称：User32.dll)
==========200h对齐，填充00===========
0AE3:0650 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0660 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0670 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0680 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0690 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:06F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0700 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0710 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0720 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0730 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0740 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0750 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0760 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0770 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0780 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0790 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:07F0 00 00 00 00 00 00 00 00-00 00 00 00 00 65 6E 64 .............end(输入函数段结束)
-------------------------------.data---------------------------------------------------------------------
0AE3:0800 48 65 6C 6C 6F 20 4C 65-72 6F 79 21 00 00 00 00 Hello Leroy!....
0AE3:0810 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................（数据段要用得到的数据）
0AE3:0820 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0830 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0840 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0850 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0860 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0870 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0880 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0890 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:08F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0900 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0910 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0920 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0930 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0940 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0950 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0960 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0970 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0980 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:0990 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0AE3:09F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
关于FirstThunk和OriginalFirstThunk的输入表调用关系。
file:///C:/Users/luoli/AppData/Local/youdao/ynote/images/4310E58FE6CA4BEDB196F123D881259D/clipboard.png
如图：
首先是IAT表，在载入内存前，存放的是函数名称的地址。然后是OriginalFirstThunk，相当于一个指针，指向INT表。然后一个红框框是name，存的是DLL名称的RVA。然后是FirstThunk，也相当于一个指针，指向IAT表。接着是INT表，存放函数的名称的地址。后面就不一定是函数名称表，和动态链接库名了。但是按VC编译的规律，INT表后面是函数名称表，然后是动态链接库名。。。
file:///C:/Users/luoli/AppData/Local/youdao/ynote/images/DDD903EFACF04796A79754DA185F5B56/clipboard.png
膜拜大神 曾经学过PE的结构
没想到 这个那么具体、 对PE很迷茫，软件有，系统有。。 膜拜大神
都是大牛 虽然我不知道能干嘛用 好贴啊，顶顶 谢谢很有用 估计下面还有两幅图吧。
页:
[1]
2