windows PE Image 文件分析（1）

约定不等于承诺〃 2022-09-19 01:54 231阅读 0赞

原文链接:http://www.mouseos.com/windows/PE\_image1.html

--------------------

![pe_20_E7_BB_93_E6_9E_84_E5_9B_BE.png][]

上面是 windows **PE** 可执行文件格式的结构图，分为 4 个部分：**DOS 文件头**、**NT 文件头**、**Section 表**以及 **Directory 表格**。

windows 的 executable **image** 文件使用的是这种 **PE** 格式，而 **object** 文件使用的是 **COFF** 文件格式。

这里仍然是延续我的风格，以实例看 image 文件格式，这次以 mircrosoft visual studio 2010 的 VC++ 9.0 编译出来经典 windows 程序为例：

这个例子是：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>// helloworld.cpp : Defines the entry point for the application.<br> //</p> <p>#include "stdafx.h"<br> #include "helloworld.h"</p> <p>#define MAX_LOADSTRING 100</p> <p>// Global Variables:<br> HINSTANCE hInst;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// current instance<br> TCHAR szTitle[MAX_LOADSTRING];&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// The title bar text<br> TCHAR szWindowClass[MAX_LOADSTRING];&nbsp;&nbsp;&nbsp;// the main window class name</p> <p>// Forward declarations of functions included in this code module:<br> ATOM&nbsp;&nbsp;&nbsp;&nbsp;MyRegisterClass(HINSTANCE hInstance);<br> BOOL&nbsp;&nbsp;&nbsp;&nbsp;InitInstance(HINSTANCE, int);<br> LRESULT CALLBACK&nbsp;WndProc(HWND, UINT, WPARAM, LPARAM);<br> INT_PTR CALLBACK&nbsp;About(HWND, UINT, WPARAM, LPARAM);</p> <p>int APIENTRY _tWinMain(HINSTANCE hInstance,<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HINSTANCE hPrevInstance,<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LPTSTR&nbsp;&nbsp;&nbsp; lpCmdLine,<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nCmdShow)<br> { <br> &nbsp;UNREFERENCED_PARAMETER(hPrevInstance);<br> &nbsp;UNREFERENCED_PARAMETER(lpCmdLine);</p> <p>&nbsp;&nbsp;// TODO: Place code here.<br> &nbsp;MSG msg;<br> &nbsp;HACCEL hAccelTable;</p> <p>&nbsp;// Initialize global strings<br> &nbsp;LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);<br> &nbsp;LoadString(hInstance, IDC_HELLOWORLD, szWindowClass, MAX_LOADSTRING);<br> &nbsp;MyRegisterClass(hInstance);</p> <p>&nbsp;// Perform application initialization:<br> &nbsp;if (!InitInstance (hInstance, nCmdShow))<br> &nbsp;{ <br> &nbsp;&nbsp;return FALSE;<br> &nbsp;}</p> <p>&nbsp;hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_HELLOWORLD));</p> <p>&nbsp;// Main message loop:<br> &nbsp;while (GetMessage(&amp;msg, NULL, 0, 0))<br> &nbsp;{ <br> &nbsp;&nbsp;if (!TranslateAccelerator(msg.hwnd, hAccelTable, &amp;msg))<br> &nbsp;&nbsp;{ <br> &nbsp;&nbsp;&nbsp;TranslateMessage(&amp;msg);<br> &nbsp;&nbsp;&nbsp;DispatchMessage(&amp;msg);<br> &nbsp;&nbsp;}<br> &nbsp;}</p> <p>&nbsp;return (int) msg.wParam;<br> }</p> <p>&nbsp;</p> <p>//<br> //&nbsp; FUNCTION: MyRegisterClass()<br> //<br> //&nbsp; PURPOSE: Registers the window class.<br> //<br> //&nbsp; COMMENTS:<br> //<br> //&nbsp;&nbsp;&nbsp; This function and its usage are only necessary if you want this code<br> //&nbsp;&nbsp;&nbsp; to be compatible with Win32 systems prior to the 'RegisterClassEx'<br> //&nbsp;&nbsp;&nbsp; function that was added to Windows 95. It is important to call this function<br> //&nbsp;&nbsp;&nbsp; so that the application will get 'well formed' small icons associated<br> //&nbsp;&nbsp;&nbsp; with it.<br> //<br> ATOM MyRegisterClass(HINSTANCE hInstance)<br> { <br> &nbsp;WNDCLASSEX wcex;</p> <p>&nbsp;wcex.cbSize = sizeof(WNDCLASSEX);</p> <p>&nbsp;wcex.style&nbsp;&nbsp;&nbsp;= CS_HREDRAW | CS_VREDRAW;<br> &nbsp;wcex.lpfnWndProc&nbsp;= WndProc;<br> &nbsp;wcex.cbClsExtra&nbsp;&nbsp;= 0;<br> &nbsp;wcex.cbWndExtra&nbsp;&nbsp;= 0;<br> &nbsp;wcex.hInstance&nbsp;&nbsp;= hInstance;<br> &nbsp;wcex.hIcon&nbsp;&nbsp;&nbsp;= LoadIcon(hInstance, MAKEINTRESOURCE(IDI_HELLOWORLD));<br> &nbsp;wcex.hCursor&nbsp;&nbsp;= LoadCursor(NULL, IDC_ARROW);<br> &nbsp;wcex.hbrBackground&nbsp;= (HBRUSH)(COLOR_WINDOW+1);<br> &nbsp;wcex.lpszMenuName&nbsp;= MAKEINTRESOURCE(IDC_HELLOWORLD);<br> &nbsp;wcex.lpszClassName&nbsp;= szWindowClass;<br> &nbsp;wcex.hIconSm&nbsp;&nbsp;= LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));</p> <p>&nbsp;return RegisterClassEx(&amp;wcex);<br> }</p> <p>//<br> //&nbsp;&nbsp; FUNCTION: InitInstance(HINSTANCE, int)<br> //<br> //&nbsp;&nbsp; PURPOSE: Saves instance handle and creates main window<br> //<br> //&nbsp;&nbsp; COMMENTS:<br> //<br> //&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; In this function, we save the instance handle in a global variable and<br> //&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; create and display the main program window.<br> //<br> BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)<br> { <br> &nbsp;&nbsp; HWND hWnd;</p> <p>&nbsp;&nbsp; hInst = hInstance; // Store instance handle in our global variable</p> <p>&nbsp;&nbsp; hWnd = CreateWindow(szWindowClass, szTitle, WS_OVERLAPPEDWINDOW,<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, NULL, NULL, hInstance, NULL);</p> <p>&nbsp;&nbsp; if (!hWnd)<br> &nbsp;&nbsp; { <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return FALSE;<br> &nbsp;&nbsp; }</p> <p>&nbsp;&nbsp; ShowWindow(hWnd, nCmdShow);<br> &nbsp;&nbsp; UpdateWindow(hWnd);</p> <p>&nbsp;&nbsp; return TRUE;<br> }</p> <p>//<br> //&nbsp; FUNCTION: WndProc(HWND, UINT, WPARAM, LPARAM)<br> //<br> //&nbsp; PURPOSE:&nbsp; Processes messages for the main window.<br> //<br> //&nbsp; WM_COMMAND&nbsp;- process the application menu<br> //&nbsp; WM_PAINT&nbsp;- Paint the main window<br> //&nbsp; WM_DESTROY&nbsp;- post a quit message and return<br> //<br> //<br> LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)<br> { <br> &nbsp;int wmId, wmEvent;<br> &nbsp;PAINTSTRUCT ps;<br> &nbsp;HDC hDC;<br> &nbsp;RECT rect;</p> <p>&nbsp;switch (message)<br> &nbsp;{ <br> &nbsp;case WM_COMMAND:<br> &nbsp;&nbsp;wmId&nbsp;&nbsp;&nbsp; = LOWORD(wParam);<br> &nbsp;&nbsp;wmEvent = HIWORD(wParam);<br> &nbsp;&nbsp;// Parse the menu selections:<br> &nbsp;&nbsp;switch (wmId)<br> &nbsp;&nbsp;{ <br> &nbsp;&nbsp;case IDM_ABOUT:<br> &nbsp;&nbsp;&nbsp;DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);<br> &nbsp;&nbsp;&nbsp;break;<br> &nbsp;&nbsp;case IDM_EXIT:<br> &nbsp;&nbsp;&nbsp;DestroyWindow(hWnd);<br> &nbsp;&nbsp;&nbsp;break;<br> &nbsp;&nbsp;default:<br> &nbsp;&nbsp;&nbsp;return DefWindowProc(hWnd, message, wParam, lParam);<br> &nbsp;&nbsp;}<br> &nbsp;&nbsp;break;<br> &nbsp;case WM_PAINT:<br> &nbsp;&nbsp;hDC = BeginPaint(hWnd, &amp;ps);<br> &nbsp;&nbsp;// TODO: Add any drawing code here...<br> &nbsp;&nbsp;GetClientRect(hWnd, &amp;rect);<br> &nbsp;&nbsp;DrawText(hDC, TEXT("hello, world"), -1, &amp;rect, DT_SINGLELINE | DT_CENTER | DT_VCENTER);<br> &nbsp;&nbsp;EndPaint(hWnd, &amp;ps);<br> &nbsp;&nbsp;break;<br> &nbsp;case WM_DESTROY:<br> &nbsp;&nbsp;PostQuitMessage(0);<br> &nbsp;&nbsp;break;<br> &nbsp;default:<br> &nbsp;&nbsp;return DefWindowProc(hWnd, message, wParam, lParam);<br> &nbsp;}<br> &nbsp;return 0;<br> }</p> <p>// Message handler for about box.<br> INT_PTR CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)<br> { <br> &nbsp;UNREFERENCED_PARAMETER(lParam);<br> &nbsp;switch (message)<br> &nbsp;{ <br> &nbsp;case WM_INITDIALOG:<br> &nbsp;&nbsp;return (INT_PTR)TRUE;</p> <p>&nbsp;case WM_COMMAND:<br> &nbsp;&nbsp;if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)<br> &nbsp;&nbsp;{ <br> &nbsp;&nbsp;&nbsp;EndDialog(hDlg, LOWORD(wParam));<br> &nbsp;&nbsp;&nbsp;return (INT_PTR)TRUE;<br> &nbsp;&nbsp;}<br> &nbsp;&nbsp;break;<br> &nbsp;}<br> &nbsp;return (INT_PTR)FALSE;<br> }</p> </td> 
  </tr> 
 </tbody> 
</table>

在窗口中间显示“hello, world”，使用的是 Win32 debug 版本编译，生成的 **helloworld.exe** 大小是 **88,576** bytes

## 1. MS-DOS 文件头 ##

在 **image** 文件的最开始处就是 **DOS** 文件头，DOS 文件头包含了 **DOS stub** 小程序。 在 **WinNT.h** 文件里定义了一个结构来描述 **DOS** 文件头。

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>typedef struct _IMAGE_DOS_HEADER {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DOS .EXE header<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_magic;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Magic number<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_cblp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Bytes on last page of file<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_cp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Pages in file<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_crlc;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Relocations<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_cparhdr;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Size of header in paragraphs<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_minalloc;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Minimum extra paragraphs needed<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_maxalloc;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Maximum extra paragraphs needed<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_ss;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Initial (relative) SS value<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Initial SP value<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_csum;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Checksum<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_ip;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Initial IP value<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_cs;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Initial (relative) CS value<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_lfarlc;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // File address of relocation table<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_ovno;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Overlay number<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_res[4];&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Reserved words<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_oemid;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // OEM identifier (for e_oeminfo)<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_oeminfo;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // OEM information; e_oemid specific<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; e_res2[10];&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Reserved words<br> &nbsp;&nbsp;&nbsp; LONG&nbsp;&nbsp; e_lfanew;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // File address of new exe header<br> &nbsp; }&nbsp;<strong>IMAGE_DOS_HEADER</strong>, *PIMAGE_DOS_HEADER;</p> </td> 
  </tr> 
 </tbody> 
</table>

这个结构名叫 **IMAGE\_DOS\_HEADER** 共 **64** bytes，以 **IMAGE\_DOS\_HEADER** 结构描述的 DOS 文件头结构从 **image** 的 **0x00000000 - 0x0000003F**（64 bytes）

结构的 **e\_magic** 域是 DOS 头文件签名，它的值是：**0x5A4D** 代表字符 **MZ**，它在 **WinNT.h** 里定义为：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>#define IMAGE_DOS_SIGNATURE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x5A4D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MZ</p> </td> 
  </tr> 
 </tbody> 
</table>

**e\_lfanew** 域是一个 offset 值，它指出 **NT** 文件头的位置。

下面看看 **helloworld.exe** 的 **DOS 文件头**内容：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F</p> <p>00000000&nbsp;&nbsp;<span style="color:rgb(255,0,0)"><strong>4D 5A</strong></span>&nbsp;90 00 03 00 00 00 04 00 00 00 FF FF 00 00&nbsp; MZ..........??..<br> 00000010&nbsp; B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00&nbsp; ?.......@.......<br> 00000020&nbsp; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&nbsp; ................<br> 00000030&nbsp; 00 00 00 00 00 00 00 00 00 00 00 00&nbsp;<span style="color:rgb(0,0,255); font-weight:bold">F0 00 00 00</span>&nbsp; ............e...</p> </td> 
  </tr> 
 </tbody> 
</table>

**红色部分**是 **DOS 签名**，**蓝色部分**是 **PE header offset**（NT 文件头）值，也就是 **IMAGE\_DOS\_HEADER** 里的 **e\_lfanew** 值，表明 NT 文件头在 image 文件的 **0x000000F0** 处。

### 1.1 DOS stub 程序 ###

在 DOS 文件头下面紧跟着一小段 **stub** 程序，从 **0x00000040 - 0x0000004D** 共 **14** bytes，这段 **dos stub** 程序是这样的：

当 **windows** 的 **PE** 文件放在 **DOS** 上执行时，将会执行这一段 **DOS stub** 程序，作用是打印信息：**This program cannot be run in DOS mode....**　然后调用 **int 21** 来终止执行返回到 **DOS**

看看它是怎样运行的：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>00000014&nbsp; 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // ip<br> 00000016&nbsp; 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // cs<br> 00000018&nbsp; 40 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // e_lfarlc</p> </td> 
  </tr> 
 </tbody> 
</table>

这个 DOS 执行环境中，**CS** 和 **IP** 被初始化为 **0**，**e\_lfarlc** 是 DOS 环境的 relocate 表，它的值是 **0x40** ，那么信息字符串的位置是：**0x0040 + 0x000e = 0x4e**，在 image 文件的 **0x0000004e** 正好这字符串的位置。

## 2. NT 文件头 ##

**NT** 文件头是 **PE** 文件头的核心部分，由 **IMAGE\_DOS\_HEADER** 结构的 **e\_lfanew** 域指出它的位置。

同样 **NT** 文件头部分由一个结构 **IMAGE\_NT\_HEADER** 来描述，在 **WinNT.h** 里定义如下：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>typedef struct _IMAGE_NT_HEADERS64 { <br> &nbsp;&nbsp;&nbsp; DWORD Signature;<br> &nbsp;&nbsp;&nbsp; IMAGE_FILE_HEADER FileHeader;<br> &nbsp;&nbsp;&nbsp; IMAGE_OPTIONAL_HEADER64 OptionalHeader;<br> }<strong>&nbsp;IMAGE_NT_HEADERS64</strong>, *PIMAGE_NT_HEADERS64;</p> <p>typedef struct _IMAGE_NT_HEADERS { <br> &nbsp;&nbsp;&nbsp; DWORD Signature;<br> &nbsp;&nbsp;&nbsp; IMAGE_FILE_HEADER FileHeader;<br> &nbsp;&nbsp;&nbsp; IMAGE_OPTIONAL_HEADER32 OptionalHeader;<br> }&nbsp;<strong>IMAGE_NT_HEADERS32</strong>, *PIMAGE_NT_HEADERS32;</p> </td> 
  </tr> 
 </tbody> 
</table>

可见这个结构分为 **32** 和 **64** 位版本，**IMAGE\_NT\_HEADER** 结构分为三大部分：

*  PE 文件签名：**Signature**
 *  **IMAGE\_FILE\_HEADER** 文件头：**FileHeader**
 *  **IMAGE\_OPTINAL\_HEADER(32/64)** 可选头：**OptionalHeader**

**IMAGE\_NT\_HEADERS32** 和 **IMAGE\_NT\_HEADERS64** 的匹别在于 **IMAGE\_OPTIONAL\_HEADER** 结构，分别为：**IMAGE\_OPTIONAL\_HEADERS32** 和 **IMAGE\_OPTIONAL\_HEADERS64**

在 **Win32** 下 **IMAGE\_NT\_HEADERS32** 是 **248** bytes，在 **Win64** 下 **IMAGE\_NT\_HEADERS64** 是 **264** bytes，因此 **helloworld.exe** 的 NT 文件头从 **0x000000F0 - 0x000001E7** 共 248 bytes

### 2.1 PE 签名 ###

在 **WinNT.h** 文件里定义了 PE 文件的签名，它是：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>#define IMAGE_NT_SIGNATURE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00004550&nbsp; // PE00</p> </td> 
  </tr> 
 </tbody> 
</table>

这个签名值是 **32** 位，值为：**0x00004550** 即：PE 的 ASCII 码，下面看看 **helloworld.exe** 中的 PE 签名：

![PE_E7_AD_BE_E5_90_8D.png][]

### 2.2 IMAGE\_FILE\_HEADER 文件头结构 ###

PE 签名接着是 **IMAGE\_FILE\_HEADER** 结构，它在 **WinNT.h** 中的定义为：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>typedef struct _IMAGE_FILE_HEADER { <br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; Machine;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; NumberOfSections;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; TimeDateStamp;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; PointerToSymbolTable;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; NumberOfSymbols;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; SizeOfOptionalHeader;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; Characteristics;<br> } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;</p> </td> 
  </tr> 
 </tbody> 
</table>

这个 **IMAGE\_FILE\_HEADER** 对 PE 文件大致的描述，这个结构共 **20** bytes，它的域描述如下：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start"> 
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <strong>域</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>size</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>值</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>描述</strong> 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Machine 
    </div> </td> 
   <td> 
    <div>
      WORD 
    </div> </td> 
   <td> 
    <div>
      IMAGE_FILE_MACHINE_xxx 
    </div> </td> 
   <td> 
    <div>
      表示目标平台 processor 类型，例： 
     <em><strong>IMAGE_FILE_MACHINE_I386</strong></em> 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      NumberOfSections 
    </div> </td> 
   <td> 
    <div>
      WORD 
    </div> </td> 
   <td> 
    <div>
      节数量 
    </div> </td> 
   <td> 
    <div>
      表示映象中有多少个 section 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      TimeDataStamp 
    </div> </td> 
   <td> 
    <div>
      DWORD 
    </div> </td> 
   <td> 
    <div>
      从1970年1月1日0:00 以来的总秒数 
    </div> </td> 
   <td> 
    <div>
      表示文件创建的时间 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      PointerToSymbolTable 
    </div> </td> 
   <td> 
    <div>
      DWORD 
    </div> </td> 
   <td> 
    <div>
      COFF 符号表偏移量 
    </div> </td> 
   <td> 
    <div>
      在 image 文件中很少见，总是为 0 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      NumberOfSymbols 
    </div> </td> 
   <td> 
    <div>
      DWORD 
    </div> </td> 
   <td> 
    <div>
      COFF 符号表的个数 
    </div> </td> 
   <td> 
    <div>
      如果存在的话，表示符号表的个数 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      SizeOfOptionalHeader 
    </div> </td> 
   <td> 
    <div>
      WORD 
    </div> </td> 
   <td> 
    <div>
      IMAGE_OPTIONAL_HEADER 结构大小 
    </div> </td> 
   <td> 
    <div>
      该域表示&nbsp; 
     <em><strong>IMAGE_NT_HEADER</strong></em>&nbsp;中的&nbsp; 
     <em><strong>IMAGE_OPTIONAL_HEADER</strong></em>&nbsp;结构的大小 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      Characteristics 
    </div> </td> 
   <td> 
    <div>
      WORD 
    </div> </td> 
   <td> 
    <div>
      IMAGE_FILE_xxx 
    </div> </td> 
   <td> 
    <div>
      表示文件属性，例如： 
     <em><strong>IMAGE_FILE_DLL</strong></em>&nbsp;属性 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

**WinNT.h** 中定义了一些常量值用来描述 **Machine**，以 **IMAGE\_FILE\_MACHINE\_XXX** 开头，下面是一些典型的常量值：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>#define IMAGE_FILE_MACHINE_UNKNOWN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0<br> #define IMAGE_FILE_MACHINE_I386&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x014c&nbsp; // Intel 386.<br> #define IMAGE_FILE_MACHINE_ALPHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0184&nbsp; // Alpha_AXP<br> #define IMAGE_FILE_MACHINE_POWERPC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x01F0&nbsp; // IBM PowerPC Little-Endian<br> #define IMAGE_FILE_MACHINE_AMD64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x8664&nbsp; // AMD64 (K8)</p> </td> 
  </tr> 
 </tbody> 
</table>

**WinNT.h** 中还针对 **Characteristics** 域定义了一些常量值，以 **IMAGE\_FILE\_XXX** 开头，代表目标 image 文件的类型，下面是一些常见的值：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>#define IMAGE_FILE_RELOCS_STRIPPED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0001&nbsp; // Relocation info stripped from file.<br> #define IMAGE_FILE_EXECUTABLE_IMAGE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0002&nbsp; // File is executable&nbsp; (i.e. no unresolved externel references).<br> #define IMAGE_FILE_LINE_NUMS_STRIPPED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0004&nbsp; // Line nunbers stripped from file.<br> #define IMAGE_FILE_LOCAL_SYMS_STRIPPED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0008&nbsp; // Local symbols stripped from file.<br> #define IMAGE_FILE_AGGRESIVE_WS_TRIM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0010&nbsp; // Agressively trim working set<br> #define IMAGE_FILE_LARGE_ADDRESS_AWARE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0020&nbsp; // App can handle &gt;2gb addresses<br> #define IMAGE_FILE_BYTES_REVERSED_LO&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0080&nbsp; // Bytes of machine word are reversed.<br> #define IMAGE_FILE_32BIT_MACHINE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0100&nbsp; // 32 bit word machine.<br> #define IMAGE_FILE_DEBUG_STRIPPED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0200&nbsp; // Debugging info stripped from file in .DBG file<br> #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP&nbsp;&nbsp; 0x0400&nbsp; // If Image is on removable media, copy and run from the swap file.<br> #define IMAGE_FILE_NET_RUN_FROM_SWAP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x0800&nbsp; // If Image is on Net, copy and run from the swap file.<br> #define IMAGE_FILE_SYSTEM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x1000&nbsp; // System File.<br> #define IMAGE_FILE_DLL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x2000&nbsp; // File is a DLL.<br> #define IMAGE_FILE_UP_SYSTEM_ONLY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x4000&nbsp; // File should only be run on a UP machine<br> #define IMAGE_FILE_BYTES_REVERSED_HI&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x8000&nbsp; // Bytes of machine word are reversed.</p> </td> 
  </tr> 
 </tbody> 
</table>

**NumberOfSections** 表示 **image** 有多个 section，另一个重要的域是：**SizeOfOptionalHeader** 它指出接下来 **IMAGE\_OPTIONAL\_HEADER** 的大小，它有两个 size：Win32 的 **0xDC** 和 Win64 的 **0xF0**

下面是 **helloworld.exe** 的 **IMAGE\_FILE\_HEADER** 结构，从 **0x000000F4 - 0x00000107** 共 20 bytes：

![helloworld_IMAGE_FILE_HEADER.png][]

将这些值分解为：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>000000F4&nbsp; 4C 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Machine<br> 000000F8&nbsp; 07 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // NumberOfSections<br> 000000FA&nbsp; 6C C6 26 4C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // TimeDateStamp<br> 000000FE&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // PointerToSymbolTable<br> 00000100&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // NumberOfSymbols<br> 00000104&nbsp; E0 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfOptionalHeader<br> 00000106&nbsp; 02 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Characteristics</p> </td> 
  </tr> 
 </tbody> 
</table>

*  Machine 是 **0x014C**，它的值是 **IMAGE\_FILE\_MACHINE\_I386**，说明这个 image 文件的目标平台是 **i386**，即：**Win32** 平台
 *  NumberOfSections 是 **0x07**，说明 image 文件内含有 7 个 **sections**
 *  SizeOfOptionalHeader 是 **0xE0**，说明接下来的 IMAGE\_OPTIONAL\_HEADERS32 将是 **0xE0**（**224 bytes**）

它的 **Characteristics** 是 **0x102** = **IMAGE\_FILE\_EXECUTABLE\_IMAGE | IMAGE\_FILE\_32BIT\_MACHINE**，说明这个 image 是 32 位可执行的映像。

### 2.3 IMAGE\_OPTIONAL\_HEADER32 结构 ###

在 **IMAGE\_FILE\_HEADER** 结构里已经指明了 image 是 **32** 位，并且 **IMAGE\_OPTIONAL\_HEADER** 的大小是 **224** bytes，那么这个结构就是 **IMAGE\_OPTIONAL\_HEADER32** 结构。

可以根据 **IMAGE\_FILE\_HEAER** 结构的 **Machine** 来判断 image 是 **Win32** 还是 **Win64** 平台的。但是 Microsoft 官方推荐及认可的方法是从 IMAGE\_OPTIONAL\_HEADER 里的 **magic** 的值来判断目标平台 。

在 WinNT.h 里 **IMAGE\_OPTIONAL\_HEADER32** 的定义如下：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>typedef struct _IMAGE_OPTIONAL_HEADER { <br> &nbsp;&nbsp;&nbsp; //<br> &nbsp;&nbsp;&nbsp; // Standard fields.<br> &nbsp;&nbsp;&nbsp; //</p> <p>&nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; Magic;<br> &nbsp;&nbsp;&nbsp; BYTE&nbsp;&nbsp;&nbsp; MajorLinkerVersion;<br> &nbsp;&nbsp;&nbsp; BYTE&nbsp;&nbsp;&nbsp; MinorLinkerVersion;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfCode;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfInitializedData;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfUninitializedData;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; AddressOfEntryPoint;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; BaseOfCode;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; BaseOfData;</p> <p>&nbsp;&nbsp;&nbsp; //<br> &nbsp;&nbsp;&nbsp; // NT additional fields.<br> &nbsp;&nbsp;&nbsp; //</p> <p>&nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; ImageBase;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SectionAlignment;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; FileAlignment;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MajorOperatingSystemVersion;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MinorOperatingSystemVersion;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MajorImageVersion;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MinorImageVersion;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MajorSubsystemVersion;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; MinorSubsystemVersion;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; Win32VersionValue;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfImage;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfHeaders;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; CheckSum;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; Subsystem;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; DllCharacteristics;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfStackReserve;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfStackCommit;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfHeapReserve;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfHeapCommit;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; LoaderFlags;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; NumberOfRvaAndSizes;<br> &nbsp;&nbsp;&nbsp; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];<br> } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;</p> </td> 
  </tr> 
 </tbody> 
</table>

**64** 位的 **IMAGE\_OPTIONAL\_HEADER64** 里没有 **BaseOfData** 域，其它的与 IMAGE\_OPTIONAL\_HEADER32 结构的域是一样的，只是一些域扩展为 64 位值，它们包括：

*  ImageBase
 *  SizeOfStackReserve
 *  SizeOfStackCommit
 *  SizeOfHeapRerserve
 *  SizeOfHeapCommit

这些域在 64 位结构里被定义为 **ULONGLONG** 类型。

从 **IMAGE\_OPTIONAL\_HEADER32** 的定义可以看出，这个结构分为 **基本域** 部分和 **附加域** 部分，它的基本域含义如下：

**Magic** 域是一个幻数值，在 **WinNT.h** 里定义了一些常量值：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>#define IMAGE_NT_OPTIONAL_HDR32_MAGIC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x10b<br> #define IMAGE_NT_OPTIONAL_HDR64_MAGIC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x20b<br> #define IMAGE_ROM_OPTIONAL_HDR_MAGIC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x107</p> </td> 
  </tr> 
 </tbody> 
</table>

*  值 **0x10b** 说明这个 image 是 32 位的，PE 文件格式是 **PE32**
 *  值 **0x20b** 说明这个 image 是 64 位的，PE 文件格式是 **PE32+**

**PE32+** 代表的扩展的 PE 文件格式，扩展为 **64** 位。在 PE 文件规范中并没有 **PE64** 这种文件格式，Microsoft 官方的判断 image 文件是 32 位还是 64 位的方法就是通过 **Magic** 的值来确定。

在这些基本的域里可以获得 linker 的版本，text 节，data 节以及 bss 节的大小，

下面看一看 **helloworld.exe** 的 **IMAGE\_OPTIONAL\_HEADER32** 结构的基本域，从 **0x00000108 - 0x0000011F**

![helloworld_IMAGE_OPTIONAL_HEADER1.png][]

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>00000108&nbsp; 0B 01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Magic<br> 0000010A&nbsp; 0A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MajorLinkerVersion<br> 0000010B&nbsp; 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MinorLinkerVersion<br> 0000010C&nbsp; 00 3C 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfCode<br> 00000110&nbsp; 00 20 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfInitializeData<br> 00000114&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfUninitializeData<br> 00000118&nbsp; 0D 12 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // AddressOfEntryPoint<br> 0000011C&nbsp; 00 10 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // BaseOfCode</p> </td> 
  </tr> 
 </tbody> 
</table>

**Magic** 是 0x010B 表明这个 image 文件是 **32** 位的 **PE32** 格式，这里看出 linker 的版本是 10.00

**.text** 节的 size 是 **0x00003C00** bytes，**.data** 节的 size 是 **0x00012000** bytes，还有一个重要的信息，代码的 **RVA** 入口在 **0x0001120D**，它是基于 **ImageBase** 的 **RVA** 值。代码的基址在 **0x00001000**，这个是 **RVA**（Relative Virtual Address）值。

下面再来看一看 **IMAGE\_OPTIONAL\_HEADER32** 结构的**附加域**：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start"> 
 <tbody> 
  <tr> 
   <td> <p><strong>Offset</strong></p> </td> 
   <td> <p><strong>Size</strong></p> </td> 
   <td> <p><strong>Field</strong></p> </td> 
   <td> <p><strong>Description</strong></p> </td> 
  </tr> 
  <tr> 
   <td> <p>24</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>BaseOfData</p> </td> 
   <td> <p>The address that is relative to the image base of the beginning-of-data section when it is loaded into memory.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>28/24</p> </td> 
   <td> <p>4/8</p> </td> 
   <td> <p>ImageBase</p> </td> 
   <td> <p>The preferred address of the first byte of image when loaded into memory; must be a multiple of 64&nbsp;K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows&nbsp;NT, Windows 2000, Windows&nbsp;XP, Windows&nbsp;95, Windows&nbsp;98, and Windows&nbsp;Me is 0x00400000.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>32/32</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>SectionAlignment</p> </td> 
   <td> <p>The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to FileAlignment. The default is the page size for the architecture.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>36/36</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>FileAlignment</p> </td> 
   <td> <p>The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64&nbsp;K, inclusive. The default is 512. If the SectionAlignment is less than the architecture’s page size, then FileAlignment must match SectionAlignment.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>40/40</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MajorOperatingSystemVersion</p> </td> 
   <td> <p>The major version number of the required operating system.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>42/42</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MinorOperatingSystemVersion</p> </td> 
   <td> <p>The minor version number of the required operating system.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>44/44</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MajorImageVersion</p> </td> 
   <td> <p>The major version number of the image.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>46/46</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MinorImageVersion</p> </td> 
   <td> <p>The minor version number of the image.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>48/48</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MajorSubsystemVersion</p> </td> 
   <td> <p>The major version number of the subsystem.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>50/50</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>MinorSubsystemVersion</p> </td> 
   <td> <p>The minor version number of the subsystem.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>52/52</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>Win32VersionValue</p> </td> 
   <td> <p>Reserved, must be zero.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>56/56</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>SizeOfImage</p> </td> 
   <td> <p>The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of SectionAlignment.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>60/60</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>SizeOfHeaders</p> </td> 
   <td> <p>The combined size of an MS?DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>64/64</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>CheckSum</p> </td> 
   <td> <p>The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>68/68</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>Subsystem</p> </td> 
   <td> <p>The subsystem that is required to run this image. For more information, see “Windows Subsystem” later in this specification.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>70/70</p> </td> 
   <td> <p>2</p> </td> 
   <td> <p>DllCharacteristics</p> </td> 
   <td> <p>For more information, see “DLL Characteristics” later in this specification.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>72/72</p> </td> 
   <td> <p>4/8</p> </td> 
   <td> <p>SizeOfStackReserve</p> </td> 
   <td> <p>The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a time until the reserve size is reached.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>76/80</p> </td> 
   <td> <p>4/8</p> </td> 
   <td> <p>SizeOfStackCommit</p> </td> 
   <td> <p>The size of the stack to commit.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>80/88</p> </td> 
   <td> <p>4/8</p> </td> 
   <td> <p>SizeOfHeapReserve</p> </td> 
   <td> <p>The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one page at a time until the reserve size is reached.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>84/96</p> </td> 
   <td> <p>4/8</p> </td> 
   <td> <p>SizeOfHeapCommit</p> </td> 
   <td> <p>The size of the local heap space to commit.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>88/104</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>LoaderFlags</p> </td> 
   <td> <p>Reserved, must be zero.</p> </td> 
  </tr> 
  <tr> 
   <td> <p>92/108</p> </td> 
   <td> <p>4</p> </td> 
   <td> <p>NumberOfRvaAndSizes</p> </td> 
   <td> <p>The number of data-directory entries in the remainder of the optional header. Each describes a location and size.</p> </td> 
  </tr> 
 </tbody> 
</table>

上面表格中的 offset 值两个，前面的是 **IMAGE\_OPTIONAL\_HEADER32** 的 offset 值，后面的是 **IMAGE\_OPTIONAL\_HEADER64**，这是因为在 64 位版本中一些域被扩展为 64 位值，而 **BaseOfData** 域在 64 位版中是不存在的。

下面是 **helloworld.exe** 的 **IMAGE\_OPTIONAL\_HEADER32** 剩余部分，从 **0x00000120 - 0x000001E7**

![helloworld_IMAGE_OPTIONAL_HEADER2.png][]

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>00000120&nbsp; 00 10 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // BaseOfData<br> 00000124&nbsp; 00 00 40 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // ImageBase<br> 00000128&nbsp; 00 10 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SectionAlignment&nbsp;<br> 0000012C&nbsp; 00 02 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // FileAlignment<br> 00000130&nbsp; 05 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MajorOperatingSystemVersion<br> 00000132&nbsp; 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MinorOperatingSystemVersion<br> 00000134&nbsp; 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MajorImageVersion<br> 00000136&nbsp; 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MinorImageVersion<br> 00000138&nbsp; 05 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MajorSubsystemVersion<br> 0000013A&nbsp; 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // MinorSubsystemVersion<br> 0000013C&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Win32VersionVAlue<br> 00000140&nbsp; 00 90 02 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfImage&nbsp;<br> 00000144&nbsp; 00 04 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfHeaders<br> 00000148&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // CheckSum<br> 0000014C&nbsp; 02 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Subsystem<br> 0000014E&nbsp; 40 81&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DllCharacteristics<br> 00000150&nbsp; 00 00 10 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfStackReserve<br> 00000154&nbsp; 00 10 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfStackCommit<br> 00000158&nbsp; 00 00 10 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfHeapReserve<br> 0000015C&nbsp; 00 10 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // SizeOfHeapCommit<br> 00000160&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // LoaderFlags<br> 00000164&nbsp; 10 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // NumberOfRvaAndSizes</p> <p>00000168&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[0]&nbsp;<br> 0000016C&nbsp; 00 00 00 00<br> <span style="color:#FF0000">00000170&nbsp; 00 80 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[1]&nbsp;<br> 00000174&nbsp; 50 00 00 00&nbsp;</span><br> <span style="color:#FF0000">00000178&nbsp; 00 90 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[2]&nbsp;<br> 0000017C&nbsp; 1C E7 00 00</span><br> 00000180&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[3]&nbsp;<br> 00000184&nbsp; 00 00 00 00&nbsp;<br> 00000188&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[4]&nbsp;<br> 0000018C&nbsp; 00 00 00 00<br> <span style="color:#FF0000">00000190&nbsp; 00 80 02 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[5]&nbsp;<br> 00000194&nbsp; 40 03 00 00&nbsp;</span><br> <span style="color:#FF0000">00000198&nbsp; 20 57 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[6]&nbsp;<br> 0000019C&nbsp; 1C 00 00 00</span><br> 000001A0&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[7]&nbsp;<br> 000001A4&nbsp; 00 00 00 00&nbsp;<br> 000001A8&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[8]&nbsp;<br> 000001AC&nbsp; 00 00 00 00<br> 000001B0&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[9]&nbsp;<br> 000001B4&nbsp; 00 00 00 00&nbsp;<br> 000001B8&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[10]&nbsp;<br> 000001BC&nbsp; 00 00 00 00&nbsp;<br> 000001C0&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[11]&nbsp;<br> 000001C4&nbsp; 00 00 00 00&nbsp;<br> <span style="color:#FF0000">000001C8&nbsp; 30 82 01 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[12]&nbsp;<br> 000001CC&nbsp; E0 01 00 00&nbsp;</span><br> 000001D0&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[13]&nbsp;<br> 000001D4&nbsp; 00 00 00 00&nbsp;<br> 000001D8&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[14]&nbsp;<br> 000001DC&nbsp; 00 00 00 00<br> 000001E0&nbsp; 00 00 00 00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // DataDirectory[15]&nbsp;<br> 000001E4&nbsp; 00 00 00 00</p> </td> 
  </tr> 
 </tbody> 
</table>

**helloworld.exe** 的 ImageBase 是 **0x00400000**，那么 helloworld.exe 映象的入口在：**ImageBase + AddressOfEntryPoint** = 0x00400000 + 0x0001120D = **0x0041120D**，这个地址是 **\_wWinMainCRTStartup()** 的入口。

上面的 **SectionAlinmen**t 域值为 0x1000 是表示映象被加载到 virtual address 以是 0x1000（4K byte）为单位的倍数，也就是加载在 virtual address 的 4K 边界上。**FileAlinment** 域的值为 0x200 表示执行映象从 0x200 为边界开始加载到 virtual address 上。

### 2.3.1 Directory 表格 ###

在 **IMAGE\_OPTIONAL\_HEADER32** 未端是一组 **IMAGE\_DATA\_DIRECTORY** 结构的数组，在 **WinNT.h** 里定义为：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>//<br> // Directory format.<br> //</p> <p>typedef struct _IMAGE_DATA_DIRECTORY { <br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; VirtualAddress;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; Size;<br> } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;</p> <p>#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES&nbsp;&nbsp;&nbsp; 16</p> </td> 
  </tr> 
 </tbody> 
</table>

**IMAGE\_NUMBEROF\_DIRECTORY\_ENTRIES** 的值为 16，因此有 16 个 **Directory**，Directory 结构中的 **VirtualAddress** 是一个 RVA 值。

这 16 个 Driectory 指引出 16 不同格式的 table，这 16 个 table 分别是：

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start"> 
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <strong>表项</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>表格</strong> 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      export table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      1 
    </div> </td> 
   <td> 
    <div>
      import table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      2 
    </div> </td> 
   <td> 
    <div>
      resource table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      3 
    </div> </td> 
   <td> 
    <div>
      exception table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      4 
    </div> </td> 
   <td> 
    <div>
      certificate table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      5 
    </div> </td> 
   <td> 
    <div>
      base relocation table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      6 
    </div> </td> 
   <td> 
    <div>
      debug 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      7 
    </div> </td> 
   <td> 
    <div>
      architecute 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      8 
    </div> </td> 
   <td> 
    <div>
      global pointer 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      9 
    </div> </td> 
   <td> 
    <div>
      TLS table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      10 
    </div> </td> 
   <td> 
    <div>
      load configuration table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      11 
    </div> </td> 
   <td> 
    <div>
      bound import 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      12 
    </div> </td> 
   <td> 
    <div>
      import address table 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      13 
    </div> </td> 
   <td> 
    <div>
      delay import descriptor 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      14 
    </div> </td> 
   <td> 
    <div>
      CLR runtime header 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      15 
    </div> </td> 
   <td> 
    <div>
      reserved, must bo zero 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

在 **WinNT.h** 有对这些 table 的结构的全部定义。

在我们的实例 **helloworld.exe** 中使用了 5 个 Driectory，也就是使用了 5 个 Data table，它们是：

*  import table
 *  resource table
 *  base relocation table
 *  debug table
 *  import address table

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start"> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      域 
    </div> </td> 
   <td> 
    <div> 
     <strong>import table</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>resource table</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>base relocation bale</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>debug table</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>import address table</strong> 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      VirtualAddress 
    </div> </td> 
   <td> 
    <div>
      0x00018000 
    </div> </td> 
   <td> 
    <div>
      0x00019000 
    </div> </td> 
   <td> 
    <div>
      0x00028000 
    </div> </td> 
   <td> 
    <div>
      0x00015720 
    </div> </td> 
   <td> 
    <div>
      0x00018230 
    </div> </td> 
  </tr> 
  <tr> 
   <td> 
    <div>
      size 
    </div> </td> 
   <td> 
    <div>
      0x50 
    </div> </td> 
   <td> 
    <div>
      0xE71C 
    </div> </td> 
   <td> 
    <div>
      0x340 
    </div> </td> 
   <td> 
    <div>
      0x1C 
    </div> </td> 
   <td> 
    <div>
      0x1E0 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

上面表格显示了 Directory 指示的 Data table 在 **virtual address** 上的位置

## 3. section 表 ##

现在来看一看 **helloworld.exe** 的 **section 表**，从 **0x000001E8 - 0x000002FF**，共 **280** bytes

这个节表结构在 **WinNT.h** 中定义为

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start; border:1px dotted rgb(204,204,204); table-layout:fixed"> 
 <tbody> 
  <tr> 
   <td style="word-wrap:break-word"> <p>//<br> // Section header format.<br> //</p> <p>#define IMAGE_SIZEOF_SHORT_NAME&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8</p> <p>typedef struct _IMAGE_SECTION_HEADER { <br> &nbsp;&nbsp;&nbsp; BYTE&nbsp;&nbsp;&nbsp; Name[IMAGE_SIZEOF_SHORT_NAME];<br> &nbsp;&nbsp;&nbsp; union { <br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; PhysicalAddress;<br> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; VirtualSize;<br> &nbsp;&nbsp;&nbsp; } Misc;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; VirtualAddress;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; SizeOfRawData;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; PointerToRawData;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; PointerToRelocations;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; PointerToLinenumbers;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; NumberOfRelocations;<br> &nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp;&nbsp; NumberOfLinenumbers;<br> &nbsp;&nbsp;&nbsp; DWORD&nbsp;&nbsp; Characteristics;<br> } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;</p> <p>#define IMAGE_SIZEOF_SECTION_HEADER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 40</p> </td> 
  </tr> 
 </tbody> 
</table>

每个 section 表的大小为 40 bytes，**section 表的作用是指出 image 映象 section 所在**

在 ***helloworld.exe*** 映象的 **IMAGE\_FILE\_HEADER** 结构的 **NumberOfSections** 域里已经指出 ***helloworld.exe*** 映象中包含有 **7 个 sections**，因此整个 section 表的大小为：**280 bytes**

***helloworld.exe*** 的 section 表如下：

![helloworld_section_E8_A1_A8.png][]

这 7 个 section 分别是：

*  .textbss 节
 *  .text 节
 *  .rdata 节
 *  .data 节
 *  .idata 节
 *  .rsrc 节
 *  .reloc 节

<table style="color:rgb(0,0,0); font-family:Simsun; text-align:start"> 
 <tbody> 
  <tr> 
   <td> 
    <div>
      域 
    </div> </td> 
   <td> 
    <div> 
     <strong>.textbss 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.text 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.rdata 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.data 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.idata 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.rsrc 节</strong> 
    </div> </td> 
   <td> 
    <div> 
     <strong>.reloc 节</strong> 
    </div> </td> 
  </tr> 
  <tr> 
   <td>VirtualSize</td> 
   <td> 
    <div>
      0x00010000 
    </div> </td> 
   <td> 
    <div>
      0x00003BDB 
    </div> </td> 
   <td> 
    <div>
      0x00001CD1 
    </div> </td> 
   <td> 
    <div>
      0x00000764 
    </div> </td> 
   <td> 
    <div>
      0x00000AAE 
    </div> </td> 
   <td> 
    <div>
      0x0000E71C 
    </div> </td> 
   <td> 
    <div>
      0x00000564 
    </div> </td> 
  </tr> 
  <tr> 
   <td>VirtualAddress</td> 
   <td> 
    <div>
      0x00001000 
    </div> </td> 
   <td> 
    <div>
      0x00011000 
    </div> </td> 
   <td> 
    <div>
      0x00015000 
    </div> </td> 
   <td> 
    <div>
      0x00017000 
    </div> </td> 
   <td> 
    <div>
      0x00018000 
    </div> </td> 
   <td> 
    <div>
      0x00019000 
    </div> </td> 
   <td> 
    <div>
      0x00028000 
    </div> </td> 
  </tr> 
  <tr> 
   <td>SizeOfRawData</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0x00003C00 
    </div> </td> 
   <td> 
    <div>
      0x00001E00 
    </div> </td> 
   <td> 
    <div>
      0x00000200 
    </div> </td> 
   <td> 
    <div>
      0x00000C00 
    </div> </td> 
   <td> 
    <div>
      0x0000E800 
    </div> </td> 
   <td> 
    <div>
      0x00000600 
    </div> </td> 
  </tr> 
  <tr> 
   <td>PointerToRawData</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0x00000400 
    </div> </td> 
   <td> 
    <div>
      0x00004000 
    </div> </td> 
   <td> 
    <div>
      0x00005E00 
    </div> </td> 
   <td> 
    <div>
      0x00006000 
    </div> </td> 
   <td> 
    <div>
      0x00006C00 
    </div> </td> 
   <td> 
    <div>
      0x00015400 
    </div> </td> 
  </tr> 
  <tr> 
   <td>PointerToRelocations</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
  </tr> 
  <tr> 
   <td>PointerToLinenumbers</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
  </tr> 
  <tr> 
   <td>NumberOfRelocations</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
  </tr> 
  <tr> 
   <td>NumberOfLinenumbers</td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
   <td> 
    <div>
      0 
    </div> </td> 
  </tr> 
  <tr> 
   <td>Characteristics</td> 
   <td> 
    <div>
      0xE00000A0 
    </div> </td> 
   <td> 
    <div>
      0x60000020 
    </div> </td> 
   <td> 
    <div>
      0x40000040 
    </div> </td> 
   <td> 
    <div>
      0xC0000040 
    </div> </td> 
   <td> 
    <div>
      0xC0000040 
    </div> </td> 
   <td> 
    <div>
      0x40000040 
    </div> </td> 
   <td> 
    <div>
      0x42000040 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

**IMAGE\_SECTION\_HEADER** 结构里的 **name** 指出 section 的名字，这个 section 名 8 个节字长。

**VirtualAddress** 是一个基于 **ImageBase** 的 **RVA** 值，它指出 section 的所在，**VirtualSize** 指出 section 的大小，**SizeOfRawData** 是在 image 文件里占有的空间，它是 **FileAlignment** 的倍数，即：**0x200** 的倍数，也就是说 **0x200** 的边界。**PointerToRawData** 是 section 在 image 文件的位置，同样也是 **FileAligment** 即：**0x200** 边界上。

--------------------

### 版权 mik 所有，转载请注明出处 ###

[pe_20_E7_BB_93_E6_9E_84_E5_9B_BE.png]: http://www.mouseos.com/images/pe%20%E7%BB%93%E6%9E%84%E5%9B%BE.png
[PE_E7_AD_BE_E5_90_8D.png]: http://www.mouseos.com/images/PE_%E7%AD%BE%E5%90%8D.png
[helloworld_IMAGE_FILE_HEADER.png]: http://www.mouseos.com/images/helloworld_IMAGE_FILE_HEADER.png
[helloworld_IMAGE_OPTIONAL_HEADER1.png]: http://www.mouseos.com/images/helloworld_IMAGE_OPTIONAL_HEADER1.png
[helloworld_IMAGE_OPTIONAL_HEADER2.png]: http://www.mouseos.com/images/helloworld_IMAGE_OPTIONAL_HEADER2.png
[helloworld_section_E8_A1_A8.png]: http://www.mouseos.com/images/helloworld_section%E8%A1%A8.png