s that will help when disassembling/examining PE files. Resource information and the such like are omitted - there are good tools available to manipulate these e.g. ResHacker. The DOS HeaderOFFSET SIZE NAME EXPLANATION
00 WORD e_magic Magic DOS signature MZ (4Dh 5Ah)
02 WORD e_cblp Bytes _disibledevent=>
06 WORD NumberOfSections Number Of Sections
08 DWORD TimeDateStamp Date & time image was created by the linker
0C DWORD Po
erToSymbolTable Zero or off of COFF symbol table in older files 10 DWORD NumberOfSymbols Number of symbols in COFF symbol table
14 WORD SizeOfOptionalHeader Size of optional header in
s (224 in 32bit exe) 16 WORD Characteristics see below
18 ********** START OF OPTIONAL HEADER **************************************
18 WORD Magic 010Bh=32-bit executable image
020Bh=64-bit executable image
0107h=ROM image
1A BYTE MajorLinkerVersion Major version number of the linker
1B BYTE MinorLinkerVersion Minor version number of the linker
1C DWORD SizeOfCode size of code section or sum
multiple code sections 20 DWORD SizeOfInitializedData as above
24 DWORD SizeOfUninitializedData as above
28 DWORD AddressOfEntryPo
Start of code execution, optional for DLLs, zero when none present 2C DWORD BaseOfCode RVA of first
of code when loaded o RAM 30 DWORD BaseOfData RVA of first
of data when loaded o RAM 34 DWORD ImageBase Preferred load address
38 DWORD SectionAlignment Alignment of sections when loaded in RAM
3C DWORD FileAlignment Alignment of sections in file _disibledevent=>
5E WORD DllCharacteristics 0001h=per-process library initialization
0002h=per-process library termination
0003h=per-thread library initialization
0004h=per-thread library termination
60 DWORD SizeOfStackReserve Number of
s reserved for the stack 64 DWORD SizeOfStackCommit Number of
s actually used for the stack 68 DWORD SizeOfHeapReserve Number of
s to reserve for the local heap 6C DWORD SizeOfHeapCommit Number of
s actually used for local heap 70 DWORD LoaderFlags This member is obsolete.
74 DWORD NumberOfRvaAndSizes Number of directory entries.
78 ********** START OF DATADIRECTORY **************************************
78 DWORD IMAGE_DATA_DIRECTORY0 RVA of Export Directory
7C DWORD size of Export Directory
80 DWORD IMAGE_DATA_DIRECTORY1 RVA of Import Directory (
84 DWORD size of Import Directory (
88 DWORD IMAGE_DATA_DIRECTORY2 RVA of Resource Directory
8C DWORD size of Resource Directory
90 DWORD IMAGE_DATA_DIRECTORY3 RVA of Exception Directory
94 DWORD size of Exception Directory
98 DWORD IMAGE_DATA_DIRECTORY4 Raw Off
of Security Directory 9C DWORD size of Security Directory
A0 DWORD IMAGE_DATA_DIRECTORY5 RVA of Base Relocation Directory
A4 DWORD size of Base Relocation Directory
A8 DWORD IMAGE_DATA_DIRECTORY6 RVA of Debug Directory
AC DWORD size of Debug Directory
B0 DWORD IMAGE_DATA_DIRECTORY7 RVA of Copyright Note
B4 DWORD size of Copyright Note
B8 DWORD IMAGE_DATA_DIRECTORY8 RVA to be used as Global Po
er (IA-64 _disibledevent=>14 DWORD NumberOfFunctions Number of entries in EAT
18 DWORD NumberOfNames Number of entries in ENT
1C DWORD AddressOfFunctions RVA of EAT (export address table)
20 DWORD AddressOfNames RVA of ENT (export name table)
24 DWORD AddressOfNameOrdinals RVA of EOT (export ordinal table)
The Import Table
Off
s shown from beginning of table (given at off 80 from start of PE header). The following 5 DWORDS repeat for each import library (DLL whose functions are imported by the executable) and ends with one full of zeroes.OFFSET SIZE NAME EXPLANATION
00 DWORD OriginalFirstThunk RVA to Image_Thunk_Data
04 DWORD TimeDateStamp zero unless bound against imported DLL
08 DWORD ForwarderChain po
er to 1st redirected function (or 0) 0C DWORD Name1 RVA to name in null-terminated ASCII
10 DWORD FirstThunk RVA to Image_Thunk_Data
Image Characteristics Flags
FLAG EXPLANATION
0001 Relocation info stripped from file
0002 File is executable (no unresolved external references)
0004 Line numbers stripped from file
0008 Local symbols stripped from file
0010 Lets OS aggressively trim working
0020 App can handle >2Gb addresses
0080 Low
s of machine word are reversed 0100 requires 32-bit WORD machine
0200 Debugging info stripped from file
o .DBG file 0400 If image is on removable media, copy and run from swap file
0800 If image is on a network, copy and run from swap file
1000
file 2000 File is a DLL
4000 File should only be run on a single-processor machine
8000 High
s of machine word are reversed Section Characteristics Flags
FLAG EXPLANATION
00000008 Section should not be padded to next boundary
00000020 Section contains code
00000040 Section contains initialised data (which will become initialised with real values before the file is launched)
00000080 Section contains uninitialised data (which will be initialised as 00
values before launch) 00000200 Section contains comments for the linker
00000800 Section contents will not become part of image
00001000 Section contents comdat (Common Block Data)
00008000 Section contents cannot be accessed relative to GP
00100000 to 00800000 Boundary alignment
tings 01000000 Section contains extended relocations
02000000 Section can be discarded (e.g. .reloc)
04000000 Section is not cacheable
08000000 Section is pageable
10000000 Section is shareable
20000000 Section is executable
40000000 Section is readable
80000000 Section is writable
最新评论