程式師世界 >> 編程語言 >> C語言 >> C++ >> 關於C++ >> PE文件格式文檔

PE文件格式文檔

編輯：關於C++

NT頭---可選頭---IMAGE_DATA_DIRECTORY---IMAGE_DIRECTORY_ENTRY_RESOURCE--->

IMAGE_SECTION_HEADER[](節頭/表)

……

節n---->IMAGE_RESOURCE_DIRECTORY_ENTRY[]---IMAGE_RESOURCE_DIRECTORY[]

-----------------0:DOS頭

-----------------1:NT頭

typedef struct _IMAGE_NT_HEADERS { DWORD Signature;//PE文件頭標志 :"PE\0\0"。在開始DOS header的偏移3CH處所指向的地址開始 IMAGE_FILE_HEADER FileHeader; //PE文件物理分布的信息 IMAGE_OPTIONAL_HEADER32 OptionalHeader;//PE文件邏輯分布的信息 } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

-----------------1.1:文件頭

typedef struct _IMAGE_FILE_HEADER { WORD Machine; //該文件運行所需要的CPU，對於Intel平台是14Ch WORD NumberOfSections; //文件的節數目 DWORD TimeDateStamp; //文件創建日期和時間 DWORD PointerToSymbolTable; //用於調試 DWORD NumberOfSymbols; //符號表中符號個數 WORD SizeOfOptionalHeader; //OptionalHeader 結構大小 WORD Characteristics; //文件信息標記，區分文件是exe還是dll } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

-----------------1.2:可選頭

typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; //標志字(總是010bh) BYTE MajorLinkerVersion; //連接器版本號 BYTE MinorLinkerVersion; // DWORD SizeOfCode; //代碼段大小 DWORD SizeOfInitializedData; //已初始化數據塊大小 DWORD SizeOfUninitializedData;//未初始化數據塊大小 DWORD AddressOfEntryPoint; //PE裝載器准備運行的PE文件的第一個指令的RVA，若要改變整個執行的流程，可以將該值指定到新的RVA，這樣新RVA處的指令首先被執行。（許多文章都有介紹RVA，請去了解） DWORD BaseOfCode; //代碼段起始RVA DWORD BaseOfData; //數據段起始RVA DWORD ImageBase; //PE文件的裝載地址 DWORD SectionAlignment; //塊對齊 DWORD FileAlignment; //文件塊對齊 WORD MajorOperatingSystemVersion;//所需操作系統版本號 WORD MinorOperatingSystemVersion;// WORD MajorImageVersion; //用戶自定義版本號 WORD MinorImageVersion; // WORD MajorSubsystemVersion; //win32子系統版本。若PE文件是專門為Win32設計的 WORD MinorSubsystemVersion; //該子系統版本必定是4.0否則對話框不會有3維立體感 DWORD Win32VersionValue; //保留 DWORD SizeOfImage; //內存中整個PE映像體的尺寸 DWORD SizeOfHeaders; //所有頭+節表的大小 DWORD CheckSum; //校驗和 WORD Subsystem; //NT用來識別PE文件屬於哪個子系統 WORD DllCharacteristics; // DWORD SizeOfStackReserve; // DWORD SizeOfStackCommit; // DWORD SizeOfHeapReserve; // DWORD SizeOfHeapCommit; // DWORD LoaderFlags; // DWORD NumberOfRvaAndSizes; // IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];//=16 } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

-----------------1.2.1:數據目錄？

typedef struct _IMAGE_DATA_DIRECTORY { DWORD VirtualAddress; //表的RVA地址 DWORD Size; //大小 } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

-----------------1.2.2數據入口

// Directory Entries #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory // IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage) #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP #define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers #define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor

-----------------1.2.2.0導出函數表？

typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; DWORD Base; DWORD NumberOfFunctions; DWORD NumberOfNames; DWORD AddressOfFunctions; // RVA from base of image DWORD AddressOfNames; // RVA from base of image DWORD AddressOfNameOrdinals; // RVA from base of image } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

-----------------1.2.2.1引入函數表

-----------------1.2.2.2資源表

-----------------1.2.2.3異常表？

-----------------1.2.2.4安全表？

-----------------1.2.2.5重定向表

-----------------1.2.2.6調試信息表

……

-----------------2:節表(段表)

typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME];//節表名稱,如“.text” union { DWORD PhysicalAddress; //物理地址 DWORD VirtualSize; //真實長度 } Misc; DWORD VirtualAddress; //RVA DWORD SizeOfRawData; //物理長度 DWORD PointerToRawData; //節基於文件的偏移量 DWORD PointerToRelocations; //重定位的偏移 DWORD PointerToLinenumbers; //行號表的偏移 WORD NumberOfRelocations; //重定位項數目 WORD NumberOfLinenumbers; //行號表的數目 DWORD Characteristics; //節屬性 } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

-----------------3:節……

-----------------3.1資源目錄(_IMAGE_RESOURCE_DIRECTORY)

typedef struct _IMAGE_RESOURCE_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; WORD NumberOfNamedEntries; WORD NumberOfIdEntries; // IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[]; } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;

----------------3.2資源目錄入口(_IMAGE_RESOURCE_DIRECTORY_ENTRY)

typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY { union { struct { DWORD NameOffset:31; DWORD NameIsString:1; }; DWORD Name; WORD Id; }; union { DWORD OffsetToData; struct { DWORD OffsetToDirectory:31; DWORD DataIsDirectory:1; }; }; } IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;

-----------------3.211資源目錄名

typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING { WORD Length; CHAR NameString[ 1 ]; } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;

-----------------3.212資源目錄Unicode名

typedef struct _IMAGE_RESOURCE_DIR_STRING_U { WORD Length; WCHAR NameString[ 1 ]; } IMAGE_RESOURCE_DIR_STRING_U, *PIMAGE_RESOURCE_DIR_STRING_U;

-----------------3.22資源數據入口

typedef struct _IMAGE_RESOURCE_DATA_ENTRY { DWORD OffsetToData;//偏移地址。並非在文件中的偏移! DWORD Size; //大小 DWORD CodePage; DWORD Reserved; } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;

-----------------9:其他

如果是在資源根目錄，id為:

1: cursor

2: bitmap

3: icon

4: menu

5: dialog

6: string table

7: font directory

8: font

9: accelerators

10: unformatted resource data