PE文件详解

小咪咪 2022-08-26 04:53 320阅读 0赞

DOS MZ头IMAGE\_DOS\_HEADERSTRUCT ：

IMAGE\_DOS\_HEADER STRUCT

\+0hWORDe\_magic //Magic DOS signature MZ(4Dh5Ah) DOS可执行文件标记

\+2h WORD e\_cblp //Bytes on last page offile

\+4hWORD e\_cp //Pages infile

\+6hWORD e\_crlc//Relocations

\+8hWORD e\_cparhdr //Size of header inparagraphs

\+0ahWORD e\_minalloc //Minimun extraparagraphs needs

\+0chWORD e\_maxalloc //Maximun extraparagraphs needs

\+0ehWORD e\_ss //intial(relative)SSvalue DOS代码的初始化堆栈SS

\+10hWORD e\_sp //intial SP valueDOS代码的初始化堆栈指针SP

\+12hWORD e\_csum//Checksum

\+14hWORD e\_ip // intial IP valueDOS代码的初始化指令入口\[指针IP\]

\+16hWORD e\_cs //intial(relative)CS valueDOS代码的初始堆栈入口

\+18hWORD e\_lfarlc //File Address ofrelocation table

\+1ahWORDe\_ovno // Overlay number

\+1chWORD e\_res\[4\] //Reservedwords

\+24hWORD e\_oemid // OEM identifier(fore\_oeminfo)

\+26hWORD e\_oeminfo // OEM information;e\_oemidspecific

\+29hWORD e\_res2\[10\] // Reservedwords

\+3chDWORD e\_lfanew //Offset to start of PEheader 指向PE文件头

\} IMAGE\_DOS\_HEADERENDS

IMAGE\_NT\_HEADERS结构：

IMAGE\_NT\_HEADERSSTRUCT

\+0hDWORDSignature //

\+4h IMAGE\_FILE\_HEADER FileHeader//

\+18hIMAGE\_OPTIONAL\_HEADER32OptionalHeader//

\} IMAGE\_NT\_HEADERSENDS

Signature字段：

在一个有效的 PE 文件里，Signature 字段被设置为00004550h, ASCII码字符是“PE00”。标志这PE 文件头的开始。

“PE00” 字符串是 PE 文件头的开始，DOS 头部的 e\_lfanew字段正是指向这里。

如下图所示：

IMAGE\_FILE\_HEADER结构

typedef       struct _IMAGE_FILE_HEADER

{

+04h        WORD              Machine;                                  // 运行平台
    +06h     WORD              NumberOfSections;         // 文件的区块数目
    +08h     DWORD     TimeDateStamp;                    // 文件创建日期和时间
    +0Ch     DWORD     PointerToSymbolTable;             // 指向符号表(主要用于调试)
    +10h     DWORD     NumberOfSymbols;          // 符号表中符号个数(同上)
    +14h     WORD              SizeOfOptionalHeader;             // IMAGE_OPTIONAL_HEADER32 结构大小
    +16h     WORD              Characteristics;                  // 文件属性
    } IMAGE_FILE_HEADER,  *PIMAGE_FILE_HEADER;

该结构如下图所示：

下边，小甲鱼童鞋为大家详细解释各个成员的含义和用法：

（1）Machine：可执行文件的目标CPU类型。

<table style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:0px; margin:0px; padding-left:0px; width:617px; padding-right:0px; border-collapse:collapse; word-wrap:break-word; empty-cells:show; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:0px"> 
 <tbody style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <th style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; background-color:rgb(229,229,229); margin:0px; padding-left:4px; padding-right:4px; font-family:'segoe Ui',Verdana,Arial; word-wrap:break-word; height:21px; font-size:1.07em; border-top:rgb(187,187,187) 1px solid; font-weight:normal; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Value</th> 
 <th style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; background-color:rgb(229,229,229); margin:0px; padding-left:4px; padding-right:4px; font-family:'segoe Ui',Verdana,Arial; word-wrap:break-word; height:21px; font-size:1.07em; border-top:rgb(187,187,187) 1px solid; font-weight:normal; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Meaning</th> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px">
 IMAGE_FILE_MACHINE_I386 0x014c 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> x86 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px">
 IMAGE_FILE_MACHINE_IA64 0x0200 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Intel Itanium </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px">
 IMAGE_FILE_MACHINE_AMD64 0x8664 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> x64 </td> 
 </tr> 
 </tbody> 
</table>

（2）NumberOfSection: 区块的数目。（注：区块表是紧跟在 IMAGE\_NT\_HEADERS后边的）

（3）TimeDataStamp: 表明文件是何时被创建的。

这个值是自1970年1月1日以来用格林威治时间（GMT）计算的秒数，这个值是比文件系统（FILESYSTEM）的日期时间更加精确的指示器。如何将这个值翻译请看：[http://bbs.fishc.com/space.php?uid=9&do=blog&id=555][http_bbs.fishc.com_space.php_uid_9_do_blog_id_555]

提示：VC的话可以用\_ctime 函数或者 gmtime 函数。

（4）PointerToSymbolTable: COFF符号表的文件偏移位置，现在基本没用了。

（5）NumberOfSymbols: 如果有COFF符号表，它代表其中的符号数目，COFF符号是一个大小固定的结构，如果想找到COFF符号表的结束位置，则需要这个变量。

（6）SizeOfOptionalHeader: 紧跟着IMAGE\_FILE\_HEADER后边的数据结构（IMAGE\_OPTIONAL\_HEADER）的大小。(对于32位PE文件，这个值通常是00E0h；对于64位PE32+文件，这个值是00F0h)。

（7）Characteristics: 文件属性，有选择的通过几个值可以运算得到。( 这些标志的有效值是定义于winnt.h 内的 IMAGE\_FILE\_\*\* 的值，具体含义见下表。普通的EXE文件这个字段的值一般是0100h，DLL文件这个字段的值一般是 210Eh。)小甲鱼温馨提示：多种属性可以通过 “或运算”使得同时拥有！

The characteristics of the image. This member can be one or more ofthe following values.

<table style="border-bottom:rgb(87,87,87) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:0px; margin:0px; padding-left:0px; width:617px; padding-right:0px; border-collapse:collapse; word-wrap:break-word; empty-cells:show; border-top:rgb(87,87,87) 1px solid; border-right:rgb(87,87,87) 1px solid; padding-top:0px"> 
 <tbody style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <th style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; background-color:rgb(229,229,229); margin:0px; padding-left:4px; padding-right:4px; font-family:'segoe Ui',Verdana,Arial; word-wrap:break-word; height:21px; font-size:1.07em; border-top:rgb(187,187,187) 1px solid; font-weight:normal; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Value</th> 
 <th style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; background-color:rgb(229,229,229); margin:0px; padding-left:4px; padding-right:4px; font-family:'segoe Ui',Verdana,Arial; word-wrap:break-word; height:21px; font-size:1.07em; border-top:rgb(187,187,187) 1px solid; font-weight:normal; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Meaning</th> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_RELOCS_STRIPPED 
 0x0001 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Relocation information was stripped from the file. The file must be loaded at its preferred base address. If the base address is not available, the loader reports an error. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_EXECUTABLE_IMAGE 
 0x0002 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The file is executable (there are no unresolved external references). </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_LINE_NUMS_STRIPPED 
 0x0004 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> COFF line numbers were stripped from the file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_LOCAL_SYMS_STRIPPED 
 0x0008 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> COFF symbol table entries were stripped from file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_AGGRESIVE_WS_TRIM 
 0x0010 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Aggressively trim the working set. This value is obsolete as of Windows 2000. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_LARGE_ADDRESS_AWARE 
 0x0020 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The application can handle addresses larger than 2 GB. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_BYTES_REVERSED_LO 
 0x0080 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The bytes of the word are reversed. This flag is obsolete. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_32BIT_MACHINE 
 0x0100 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The computer supports 32-bit words. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_DEBUG_STRIPPED 
 0x0200 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> Debugging information was removed and stored separately in another file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 
 0x0400 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> If the image is on removable media, copy it to and run it from the swap file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_NET_RUN_FROM_SWAP 
 0x0800 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> If the image is on the network, copy it to and run it from the swap file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_SYSTEM 
 0x1000 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The image is a system file. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_DLL 
 0x2000 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The image is a DLL file. While it is an executable file, it cannot be run directly. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_UP_SYSTEM_ONLY 
 0x4000 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The file should be run only on a uniprocessor computer. </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; vertical-align:top; padding-top:0px"> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> <a rel="nofollow"></a> 
 <dl style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 IMAGE_FILE_BYTES_REVERSED_HI 
 0x8000 
 </dl> </td> 
 <td style="border-bottom:rgb(187,187,187) 1px solid; border-left:rgb(187,187,187) 1px solid; padding-bottom:4px; line-height:18px; margin:1px; padding-left:4px; padding-right:4px; word-wrap:break-word; border-top:rgb(187,187,187) 1px solid; border-right:rgb(187,187,187) 1px solid; padding-top:4px"> The bytes of the word are reversed. This flag is obsolete. </td> 
 </tr> 
 </tbody> 
</table>

IMAGE\_OPTIONAL\_HEADER结构：

typedef struct \_IMAGE\_OPTIONAL\_HEADER  
\{   
//  
// Standard fields.  
//  
\+18h WORD Magic; // 标志字, ROM映像（0107h）,普通可执行文件（010Bh）  
\+1Ah BYTE MajorLinkerVersion; // 链接程序的主版本号  
\+1Bh BYTE MinorLinkerVersion; // 链接程序的次版本号  
\+1Ch DWORD SizeOfCode; // 所有含代码的节的总大小  
\+20h DWORD SizeOfInitializedData; //所有含已初始化数据的节的总大小  
\+24h DWORD SizeOfUninitializedData; //所有含未初始化数据的节的大小  
\+28h DWORD AddressOfEntryPoint; // 程序执行入口RVA  
\+2Ch DWORD BaseOfCode; // 代码的区块的起始RVA  
\+30h DWORD BaseOfData; // 数据的区块的起始RVA  
//  
// NT additional fields. 以下是属于NT结构增加的领域。  
//  
\+34h DWORD ImageBase; // 程序的首选装载地址  
\+38h DWORD SectionAlignment; // 内存中的区块的对齐大小  
\+3Ch DWORD FileAlignment; // 文件中的区块的对齐大小  
\+40h WORD MajorOperatingSystemVersion; //要求操作系统最低版本号的主版本号  
\+42h WORD MinorOperatingSystemVersion; //要求操作系统最低版本号的副版本号  
\+44h WORD MajorImageVersion; // 可运行于操作系统的主版本号  
\+46h WORD MinorImageVersion; // 可运行于操作系统的次版本号  
\+48h WORD MajorSubsystemVersion; // 要求最低子系统版本的主版本号  
\+4Ah WORD MinorSubsystemVersion; // 要求最低子系统版本的次版本号  
\+4Ch DWORD Win32VersionValue; //莫须有字段，不被病毒利用的话一般为0  
\+50h DWORD SizeOfImage; // 映像装入内存后的总尺寸  
\+54h DWORD SizeOfHeaders; // 所有头 + 区块表的尺寸大小  
\+58h DWORD CheckSum; // 映像的校检和  
\+5Ch WORD Subsystem; // 可执行文件期望的子系统  
\+5EhWORD DllCharacteristics; // DllMain()函数何时被调用，默认为 0  
\+60h DWORD SizeOfStackReserve; // 初始化时的栈大小  
\+64h DWORD SizeOfStackCommit; // 初始化时实际提交的栈大小  
\+68h DWORD SizeOfHeapReserve; // 初始化时保留的堆大小  
\+6Ch DWORD SizeOfHeapCommit; // 初始化时实际提交的堆大小  
\+70h DWORD LoaderFlags; // 与调试有关，默认为 0  
\+74h DWORD NumberOfRvaAndSizes; // 下边数据目录的项数，这个字段自Windows NT 发布以来// 一直是16  
\+78h IMAGE\_DATA\_DIRECTORYDataDirectory\[IMAGE\_NUMBEROF\_DIRECTORY\_ENTRIES\];  
// 数据目录表  
\} IMAGE\_OPTIONAL\_HEADER32,\*PIMAGE\_OPTIONAL\_HEADER32;

事实上，这个结构中的大部分字段都不重要，大家可以从注释中理解它们的含义，小甲鱼将比较重要的字段在下边跟大家详细讲解。另外，这玩意千万不要去背啊，我们要把绝大多数的时间拿来改变，而不是记住。不用做笔记，把这篇文章转载到您的博客就行（最好注明：小甲鱼是帅哥）吼吼^\_^

●AddressOfEntryPoint字段

指出文件被执行时的入口地址，这是一个RVA地址（RVA的含义在下一节中详细介绍）。如果在一个可执行文件上附加了一段代码并想让这段代码首先被执行，那么只需要将这个入口地址指向附加的代码就可以了。

● ImageBase字段

指出文件的优先装入地址。也就是说当文件被执行时，如果可能的话，Windows优先将文件装入到由ImageBase字段指定的地址中，只有指定的地址已经被\*\*模块使用时，文件才被装入到\*\*地址中。链接器产生可执行文件的时候对应这个地址来生成机器码，所以当文件被装入这个地址时不需要进行重定位操作，装入的速度最快，如果文件被装载到\*\*地址的话，将不得不进行重定位操作，这样就要慢一点。

对于EXE文件来说，由于每个文件总是使用独立的虚拟地址空间，优先装入地址不可能被\*\*模块占据，所以EXE总是能够按照这个地址装入，这也意味着EXE文件不再需要重定位信息。对于DLL文件来说，由于多个DLL文件全部使用宿主EXE文件的地址空间，不能保证优先装入地址没有被\*\*的DLL使用，所以DLL文件中必须包含重定位信息以防万一。因此，在前面介绍的IMAGE\_FILE\_HEADER 结构的 Characteristics 字段中，DLL 文件对应的IMAGE\_FILE\_RELOCS\_STRIPPED位总是为0，而EXE文件的这个标志位总是为1。

在链接的时候，可以通过对link.exe指定/base:address选项来自定义优先装入地址，如果不指定这个选项的话，一般EXE文件的默认优先装入地址被定为00400000h，而DLL文件的默认优先装入地址被定为10000000h。

● SectionAlignment 字段和FileAlignment字段

SectionAlignment字段指定了节被装入内存后的对齐单位。也就是说，每个节被装入的地址必定是本字段指定数值的整数倍。而FileAlignment字段指定了节存储在磁盘文件中时的对齐单位。

● Subsystem字段

指定使用界面的子系统，它的取值如表17.3所示。这个字段决定了系统如何为程序建立初始的界面，链接时的/subsystem:\*\*选项指定的就是这个字段的值，在前面章节的编程中我们早已知道：如果将子系统指定为WindowsCUI，那么系统会自动为程序建立一个控制台窗口，而指定为WindowsGUI的话，窗口必须由程序自己建立。

界面子系统的取值和含义

● DataDirectory字段

这个字段可以说是最重要的字段之一，它由16个相同的IMAGE\_DATA\_DIRECTORY结构组成，虽然PE文件中的数据是按照装入内存后的页属性归类而被放在不同的节中的，但是这些处于各个节中的数据按照用途可以被分为导出表、导入表、资源、重定位表等数据块，这16个IMAGE\_DATA\_DIRECTORY结构就是用来定义多种不同用途的数据块的（如表17.4所示）。IMAGE\_DATA\_DIRECTORY结构的定义很简单，它仅仅指出了某种数据块的位置和长度。

IMAGE\_DATA\_DIRECTORY STRUCT

VirtualAddress DWORD ?；数据的起始RVA

isize DWORD ? ；数据块的长度

IMAGE\_DATA\_DIRECTORY ENDS

数据目录列表的含义

<table style="padding-bottom:0px; line-height:21px; margin:0px; padding-left:0px; width:698px; padding-right:0px; border-collapse:collapse; word-wrap:break-word; empty-cells:show; font-size:14px; padding-top:0px"> 
 <tbody style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 索 引 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 索引值在Windows.inc中的预定义值 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 对应的数据块 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 0 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_EXPORT </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 导出表 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 1 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_IMPORT </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 导入表 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 2 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_RESOURCE </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 资源 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 3 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_EXCEPTION </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 异常（具体资料不详） </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 4 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_SECURITY </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 安全（具体资料不详） </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 5 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_BASERELOC </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 重定位表 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 6 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_DEBUG </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 调试信息 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 7 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_ARCHITECTURE </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 版权信息 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 8 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_GLOBALPTR </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 具体资料不详 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 9 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_TLS </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> Thread Local Storage </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 10 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 具体资料不详 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 11 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 具体资料不详 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 12 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_IAT </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 导入函数地址表 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 13 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 具体资料不详 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 14 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 具体资料不详 </td> 
 </tr> 
 <tr style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 15 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> 未使用 </td> 
 <td style="padding-bottom:0px; margin:0px; padding-left:0px; padding-right:0px; word-wrap:break-word; padding-top:0px"> </td> 
 </tr> 
 </tbody> 
</table>

在PE文件中寻找特定的数据时就是从这些IMAGE\_DATA\_DIRECTORY结构开始的，比如要存取资源，那么必须从第3个IMAGE\_DATA\_DIRECTORY结构（索引为2）中得到资源数据块的大小和位置；同理，如果要查看PE文件导入了哪些DLL文件的哪些API函数，那就必须首先从第2个IMAGE\_DATA\_DIRECTORY结构得到导入表的位置和大小。

[http_bbs.fishc.com_space.php_uid_9_do_blog_id_555]: http://bbs.fishc.com/space.php?uid=9&do=blog&id=555