1. DOS头
struct _IMAGE_DOS_HEADER {
WORD e_magic; //5A 4D //(!重要) |"MZ标记"
WORD e_cblp; //AA CC //CC是为了让程序断下
WORD e_cp; //AA AA
WORD e_crlc; //AA AA
WORD e_cparhdr; //AA AA
WORD e_minalloc; //AA AA
WORD e_maxalloc; //AA AA
WORD e_ss; //AA AA
WORD e_sp; //AA AA
WORD e_csum; //AA AA
WORD e_ip; //AA AA
WORD e_cs; //AA AA
WORD e_lfarlc; //AA AA
WORD e_ovno; //AA AA
WORD e_res[4]; //AA AA AA AA AA AA AA AA
WORD e_oemid; //AA AA
WORD e_oeminfo; //AA AA
WORD e_res2[10]; //20个A
DWORD e_lfanew; //00 00 00 40 //(!重要) |用于定位PE标识
};
2. NT头
struct _IMAGE_NT_HEADERS{
DWORD Signature; //00 00 45 50 //(!重要) |PE标识
_IMAGE_FILE_HEADER FileHeader;
_IMAGE_OPTIONAL_HEADER OptionalHeader;
}
2. 标准PE头(大小固定)
struct _IMAGE_FILE_HEADER {
WORD Machine; //01 4C //(!重要)
WORD NumberOfSections; //00 01 //(!重要) |节总数(1)
DWORD TimeDateStamp; //AA AA AA AA
DWORD PointerToSymbolTable; //AA AA AA AA
DWORD NumberOfSymbols; //AA AA AA AA
WORD SizeOfOptionalHeader; //00 80 //(!重要) |可选PE头的大小
WORD Characteristics; //01 0F //(!重要) |可执行文件值为10F
};
3. 可选PE头((大小不固定,32和64不同))
struct _IMAGE_OPTIONAL_HEADER {
WORD Magic; //01 0B //(!重要) |10B-32位下的PE文件
BYTE MajorLinkerVersion; //AA
BYTE MinorLinkerVersion; //AA
DWORD SizeOfCode; //AA AA AA AA
DWORD SizeOfInitializedData; //AA AA AA AA
DWORD SizeOfUninitializedData; //AA AA AA AA
DWORD AddressOfEntryPoint; //00 00 00 02 //(!重要) |程序入口点(02,断在CC处)
DWORD BaseOfCode; //AA AA AA AA
DWORD BaseOfData; //AA AA AA AA
DWORD ImageBase; //00 40 00 00 //(!重要) |内存镜像基址
DWORD SectionAlignment; //00 00 10 00 //(!重要) |内存对齐
DWORD FileAlignment; //00 00 02 00 //(!重要) |文件对齐
WORD MajorOperatingSystemVersion; //AA AA
WORD MinorOperatingSystemVersion; //AA AA
WORD MajorImageVersion; //AA AA
WORD MinorImageVersion; //AA AA
WORD MajorSubsystemVersion; //00 04 //(!重要) |子系统版本号
WORD MinorSubsystemVersion; //AA AA
DWORD Win32VersionValue; //AA AA AA AA
DWORD SizeOfImage; //00 00 20 00 //(!重要) |PE文件映射到内存后的尺寸,SectionAlignment的倍数
DWORD SizeOfHeaders; //00 00 02 00 //(!重要) |所有头+节表按照文件对齐后的大小
DWORD CheckSum; //AA AA AA AA
WORD Subsystem; //00 02 //(!重要) |子系统
WORD DllCharacteristics; //00 00 //(!重要) |
DWORD SizeOfStackReserve; //00 40 00 00 //(!重要) |初始化时保留的栈大小(桟最大值)
DWORD SizeOfStackCommit; //00 00 10 00 //(!重要) |初始化时实际提交的栈大小(实际使用桟大小)
DWORD SizeOfHeapReserve; //00 10 00 00 //(!重要) |初始化时保留的堆大小(堆最大值)
DWORD SizeOfHeapCommit; //00 01 00 00 //(!重要) |初始化时实际提交的堆大小(实际使用堆大小)
DWORD LoaderFlags; //AA AA AA AA
DWORD NumberOfRvaAndSizes; //00 00 00 04 //(!重要) |目录项数目(4),其实最优是2项,有导入表即可
_IMAGE_DATA_DIRECTORY DataDirectory[16]; //目录项(4个目录项,先全初始化为0)
};
4. 节表
#define IMAGE_SIZEOF_SHORT_NAME 8
typedef struct _IMAGE_SECTION_HEADER
{
BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; //EE EE EE EE EE EE EE EE
union
{
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc; //00 00 10 00 //(!重要) |提交到内存中大小
DWORD VirtualAddress; //00 00 10 00 //(!重要) |提交到内存中的偏移
DWORD SizeOfRawData; //00 00 20 00 //(!重要) |节在文件中对齐后的尺寸
DWORD PointerToRawData; //00 00 02 00 //(!重要) |节在文件中的偏移
DWORD PointerToRelocations; //AA AA AA AA
DWORD PointerToLinenumbers; //AA AA AA AA
WORD NumberOfRelocations; //AA AA
WORD NumberOfLinenumbers; //AA AA
DWORD Characteristics; //60 AA AA AA //(!重要) |节的属性 高位给运行属性即可
};
[复制链接]
发表于 2018-2-19 18:43
|
发表于 2018-2-19 22:19
3.2.5 修改可选PE头SizeOfImage成员
3.2.13 修改OEP
四.尾声
