DOS MZ header 64byte 19个成员
-------------------------------
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
1 WORD e_magic; // Magic number
2 WORD e_cblp; // Bytes on last page of file
3 WORD e_cp; // Pages in file
4 WORD e_crlc; // Relocations
5 WORD e_cparhdr; // Size of header in paragraphs
6 WORD e_minalloc; // Minimum extra paragraphs needed
7 WORD e_maxalloc; // Maximum extra paragraphs needed
8 WORD e_ss; // Initial (relative) SS value
9 WORD e_sp; // Initial SP value
10 WORD e_csum; // Checksum
11 WORD e_ip; // Initial IP value
12 WORD e_cs; // Initial (relative) CS value
13 WORD e_lfarlc; // File address of relocation table
14 WORD e_ovno; // Overlay number
15 WORD e_res[4]; // Reserved words
16 WORD e_oemid; // OEM identifier (for e_oeminfo)
17 WORD e_oeminfo; // OEM information; e_oemid specific
18 WORD e_res2[10]; // Reserved words
19 LONG e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
-----------------------------------
DOS STUD
----------------------------------
PE 文件头
----------------------------------
typedef struct _IMAGE_NT_HEADERS {
DWORD Signature; 4byte PE00
IMAGE_FILE_HEADER FileHeader; 20byte
IMAGE_OPTIONAL_HEADER32 OptionalHeader; 大小FILE_HEAD中指出
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
typedef struct _IMAGE_FILE_HEADER {
1 WORD Machine; CPU类型
2 WORD NumberOfSections; 节树目
3 DWORD TimeDateStamp;
4 DWORD PointerToSymbolTable;
5 DWORD NumberOfSymbols;
6 WORD SizeOfOptionalHeader; OPTIONAL大小
7 WORD Characteristics; 标志文件是DLL或EXE等等信息
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
typedef struct _IMAGE_OPTIONAL_HEADER {
//
// Standard fields.
//
1 WORD Magic; 表示文件的格式，值为0x010B表示.EXE文件，为0x0107表示ROM映像
2 BYTE MajorLinkerVersion;
3 BYTE MinorLinkerVersion;
4 DWORD SizeOfCode;
5 DWORD SizeOfInitializedData;
6 DWORD SizeOfUninitializedData;
7 DWORD AddressOfEntryPoint; 程序入口点
8 DWORD BaseOfCode; 代码基址
9 DWORD BaseOfData; 数据基址
//
// NT additional fields.
//
10 DWORD ImageBase; 映射后的基址
11 DWORD SectionAlignment; 内存节对齐数据，一般为1000H
12 DWORD FileAlignment; 文件对齐数据，一般为200H
13 WORD MajorOperatingSystemVersion;
14 WORD MinorOperatingSystemVersion;
15 WORD MajorImageVersion;
16 WORD MinorImageVersion;
17 WORD MajorSubsystemVersion;
18 WORD MinorSubsystemVersion;
19 DWORD Win32VersionValue;
20 DWORD SizeOfImage; 整个PE文件映射内存后的大小
21 DWORD SizeOfHeaders; PE头+节表大小（也就是不包括各节的大小）
22 DWORD CheckSum;
23 WORD Subsystem;
24 WORD DllCharacteristics;
25 DWORD SizeOfStackReserve;
26 DWORD SizeOfStackCommit;
27 DWORD SizeOfHeapReserve;
28 DWORD SizeOfHeapCommit;
29 DWORD LoaderFlags;
30 DWORD NumberOfRvaAndSizes; 31成员（数据目录）的数目
31 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
IMAGE_DIRECTORY_ENTRY_EXPORT (0)导出目录用于DLL
IMAGE_DIRECTORY_ENTRY_IMPORT (1导入目录
IMAGE_DIRECTORY_ENTRY_RESOURCE (2)资源目录
IMAGE_DIRECTORY_ENTRY_EXCEPTION (3)异常目录
IMAGE_DIRECTORY_ENTRY_SECURITY (4)安全目录
IMAGE_DIRECTORY_ENTRY_BASERELOC (5)重定位表
IMAGE_DIRECTORY_ENTRY_DEBUG (6)调试目录
IMAGE_DIRECTORY_ENTRY_COPYRIGHT (7)描述版权串
IMAGE_DIRECTORY_ENTRY_GLOBALPTR (8)机器值
IMAGE_DIRECTORY_ENTRY_TLS (9)Thread local storage目录
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG (10)Load configuration 目录
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (11)Bound import directory目录
IMAGE_DIRECTORY_ENTRY_IAT (12)Import Address Table输入地址表目录
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
----------------------------------------
节表section table
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; 节名称
union {
DWORD PhysicalAddress;
DWORD VirtualSize; 节有效代码所占字节
} Misc;
DWORD VirtualAddress; 节RVA
DWORD SizeOfRawData; 节在文件中对齐后大小
DWORD PointerToRawData; 节在文件中的起始地址
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics; 节属性
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;