zoukankan      html  css  js  c++  java
  • COFF文件

    • SimpleSection.c文件
      • int printf(const char* format,...);
        
        int global_int_var = 84;
        int global_unint_var;
        
        void func1(int i)
        {
        	printf("%d\n",i);
        }
        
        int main(void)
        {
        	static int static_var = 85;
        	static int static_var2;	
        	int a = 1;
        	int b;
        
        	func1(static_var + static_var2 + a + b);
        
        	return 0;
        }
    • cl /c SimpleSection.c ---->SimpleSection.obj
    • dumpbin /all SimpleSection.obj
      • Microsoft (R) COFF/PE Dumper Version 8.00.50727.762
        Copyright (C) Microsoft Corporation.  All rights reserved.
        
        
        Dump of file simplesection.obj
        
        File Type: COFF OBJECT
        
        FILE HEADER VALUES
                     14C machine (x86)
                       5 number of sections
                4E43414B time date stamp Thu Aug 11 10:41:15 2011
                     1F2 file pointer to symbol table
                      14 number of symbols
                       0 size of optional header
                       0 characteristics
        
        SECTION HEADER #1
        .drectve name
               0 physical address
               0 virtual address
              2F size of raw data
              DC file pointer to raw data (000000DC to 0000010A)
               0 file pointer to relocation table
               0 file pointer to line numbers
               0 number of relocations
               0 number of line numbers
          100A00 flags
                 Info
                 Remove
                 1 byte align
        
        RAW DATA #1
          00000000: 20 20 20 2F 44 45 46 41 55 4C 54 4C 49 42 3A 22     /DEFAULTLIB:"
          00000010: 4C 49 42 43 4D 54 22 20 2F 44 45 46 41 55 4C 54  LIBCMT" /DEFAULT
          00000020: 4C 49 42 3A 22 4F 4C 44 4E 41 4D 45 53 22 20     LIB:"OLDNAMES" 
        
           Linker Directives
           -----------------
           /DEFAULTLIB:"LIBCMT"
           /DEFAULTLIB:"OLDNAMES"
        
        SECTION HEADER #2
        .debug$S name
               0 physical address
               0 virtual address
              5B size of raw data
             10B file pointer to raw data (0000010B to 00000165)
               0 file pointer to relocation table
               0 file pointer to line numbers
               0 number of relocations
               0 number of line numbers
        42100040 flags
                 Initialized Data
                 Discardable
                 1 byte align
                 Read Only
        
        RAW DATA #2
          00000000: 02 00 00 00 1B 00 09 00 00 00 00 00 14 45 3A 5C  .............E:\
          00000010: 73 69 6D 70 6C 65 73 65 63 74 69 6F 6E 2E 6F 62  simplesection.ob
          00000020: 6A 38 00 13 10 00 22 00 00 07 00 0E 00 00 00 27  j8...."........'
          00000030: C6 0E 00 00 00 27 C6 21 4D 69 63 72 6F 73 6F 66  ?....'?!Microsof
          00000040: 74 20 28 52 29 20 4F 70 74 69 6D 69 7A 69 6E 67  t (R) Optimizing
          00000050: 20 43 6F 6D 70 69 6C 65 72 00 00                  Compiler..
        
        SECTION HEADER #3
           .data name
               0 physical address
               0 virtual address
               C size of raw data
             166 file pointer to raw data (00000166 to 00000171)
               0 file pointer to relocation table
               0 file pointer to line numbers
               0 number of relocations
               0 number of line numbers
        C0300040 flags
                 Initialized Data
                 4 byte align
                 Read Write
        
        RAW DATA #3
          00000000: 54 00 00 00 25 64 0A 00 55 00 00 00              T...%d..U...
        
        SECTION HEADER #4
           .text name
               0 physical address
               0 virtual address
              4E size of raw data
             172 file pointer to raw data (00000172 to 000001BF)
             1C0 file pointer to relocation table
               0 file pointer to line numbers
               5 number of relocations
               0 number of line numbers
        60500020 flags
                 Code
                 16 byte align
                 Execute Read
        
        RAW DATA #4
          00000000: 55 8B EC 8B 45 08 50 68 00 00 00 00 E8 00 00 00  U.ì.E.Ph....è...
          00000010: 00 83 C4 08 5D C3 CC CC CC CC CC CC CC CC CC CC  ..?.]?ìììììììììì
          00000020: 55 8B EC 83 EC 08 C7 45 FC 01 00 00 00 A1 00 00  U.ì.ì.?Eü....?..
          00000030: 00 00 03 05 00 00 00 00 03 45 FC 03 45 F8 50 E8  .........Eü.E?Pè
          00000040: 00 00 00 00 83 C4 04 8B 45 FC 8B E5 5D C3        .....?..Eü.?]?
        
        RELOCATIONS #4
                                                        Symbol    Symbol
         Offset    Type              Applied To         Index     Name
         --------  ----------------  -----------------  --------  ------
         00000008  DIR32                      00000000         A  $SG612
         0000000D  REL32                      00000000         F  _printf
         0000002E  DIR32                      00000000         B  ?static_var@?1??main@@9@9 (`main'::`2'::static_var)
         00000034  DIR32                      00000000        13  ?static_var2@?1??main@@9@9 (`main'::`2'::static_var2)
         00000040  REL32                      00000000         E  _func1
        
        SECTION HEADER #5
            .bss name
               0 physical address
               0 virtual address
               4 size of raw data
               0 file pointer to raw data
               0 file pointer to relocation table
               0 file pointer to line numbers
               0 number of relocations
               0 number of line numbers
        C0300080 flags
                 Uninitialized Data
                 4 byte align
                 Read Write
        
        COFF SYMBOL TABLE
        000 006DC627 ABS    notype       Static       | @comp.id
        001 00000001 ABS    notype       Static       | @feat.00
        002 00000000 SECT1  notype       Static       | .drectve
            Section length   2F, #relocs    0, #linenums    0, checksum        0
        004 00000000 SECT2  notype       Static       | .debug$S
            Section length   5B, #relocs    0, #linenums    0, checksum        0
        006 00000004 UNDEF  notype       External     | _global_unint_var
        007 00000000 SECT3  notype       Static       | .data
            Section length    C, #relocs    0, #linenums    0, checksum AC5AB941
        009 00000000 SECT3  notype       External     | _global_int_var
        00A 00000004 SECT3  notype       Static       | $SG612
        00B 00000008 SECT3  notype       Static       | ?static_var@?1??main@@9@9 (`main'::`2'::static_var)
        00C 00000000 SECT4  notype       Static       | .text
            Section length   4E, #relocs    5, #linenums    0, checksum CC61DB94
        00E 00000000 SECT4  notype ()    External     | _func1
        00F 00000000 UNDEF  notype ()    External     | _printf
        010 00000020 SECT4  notype ()    External     | _main
        011 00000000 SECT5  notype       Static       | .bss
            Section length    4, #relocs    0, #linenums    0, checksum        0
        013 00000000 SECT5  notype       Static       | ?static_var2@?1??main@@9@9 (`main'::`2'::static_var2)
        
        String Table Size = 0x5B bytes
        
          Summary
        
                   4 .bss
                   C .data
                  5B .debug$S
                  2F .drectve
                  4E .text
    • 拆解SimpleSection.obj
      • ====Image Header====
        4C01//machine (x86)
        0500//5个段
        4B41434E//时间戳
        F2010000//符号表地址
        14000000//符号数
        0000//可选头大小
        0000//标志
        
        ====段表====
        
        2E64726563747665//.drectve
        00000000
        00000000
        2F000000//段数据大小
        DC000000//段数据起始位置
        00000000
        00000000
        0000
        0000
        000A1000//段标志字
        
        2E64656275672453//.debug$S
        00000000
        00000000
        5B000000
        0B010000
        00000000
        00000000
        0000
        0000
        40001042
        
        2E64617461000000//.data
        00000000
        00000000
        0C000000
        66010000
        00000000
        00000000
        0000
        0000
        400030C0
        
        2E74657874000000//.text
        00000000
        00000000
        4E000000
        72010000
        C0010000//重定位数据位置
        00000000
        0500//重定位数据大小
        0000
        20005060
        
        2E62737300000000//.bss
        00000000
        00000000
        04000000
        00000000
        00000000
        00000000
        0000
        0000
        800030C0
        
        ====RAW DATA====
        
        //#1
        2020202F44454641554C544C49423A22
        4C4942434D5422202F44454641554C54
        4C49423A224F4C444E414D45532220
        
        //#2
        020000001B0009000000000014453A5C
        73696D706C6573656374696F6E2E6F62
        6A380013100022000007000E00000027
        C60E00000027C6214D6963726F736F66
        7420285229204F7074696D697A696E67
        20436F6D70696C65720000
        
        //#3
        5400000025640A0055000000
        
        //#4
        558BEC8B4508506800000000E8000000
        0083C4085DC3CCCCCCCCCCCCCCCCCCCC
        558BEC83EC08C745FC01000000A10000
        00000305000000000345FC0345F850E8
        0000000083C4048B45FC8BE55DC3
        
        ====重定位表====
        
        08000000//重定位入口的段内偏移
        0A000000//在符号表内的索引
        0600//属性:重定位目标的32位虚拟地址
        
        0D000000
        0F000000//在符号表内的索引---->_printf
        1400//属性:重定位目标的32位相对偏移
        
        2E000000
        0B000000
        0600
        
        34000000
        13000000
        0600
        
        40000000
        0E000000
        1400
        
        ====符号表====//通过符号大小和序号计算符号段内偏移地址?
        
        40636F6D702E6964//@comp.id
        27C66D00//符号大小
        FFFF
        0000//符号类型:变量及其他
        03//可见类型:static
        00
        
        40666561742E3030//@feat.00
        01000000
        FFFF
        0000
        03
        00
        
        2E64726563747665//.drectve
        00000000
        0100//段号:1
        0000
        03
        01//1个附加信息
        2F0000000000000000000000000000000000
        
        2E64656275672453//.debug$S
        00000000
        0200
        0000
        03
        01
        5B0000000000000000000000000000000000
        
        00000000//为0,则后四字节为字符串偏移
        04000000//字符串表偏移4--->_global_unint_var
        04000000//大小为4
        0000
        0000//符号类型:变量及其他
        02//可见类型:external
        00
        
        2E64617461000000//.data\0\0\0
        00000000
        0300
        0000
        03
        01
        0C0000000000000041B95AAC000000000000
        
        00000000
        16000000//字符串表偏移22--->_global_int_var
        00000000//??
        0300//段号:3
        0000
        02//可见类型:external
        00
        
        2453473631320000//$SG612\0\0
        04000000
        0300
        0000
        03
        00
        000000002600000008000000030000000300
        
        2E74657874000000//.text\0\0\0
        00000000
        0400
        0000
        03
        01
        4E0000000500000094DB61CC000000000000
        
        5F66756E63310000//_func1\0\0
        00000000
        0400
        2000//符号类型:函数
        02
        00
        
        5F7072696E746600//_printf\0
        00000000
        0000
        2000
        02
        00
        
        5F6D61696E000000//_main\0\0\0
        20000000//大小
        0400//段号
        2000//符号类型:函数
        02//可见类型:external
        00
        
        2E62737300000000//.bss\0\0\0\0
        00000000
        0500
        0000
        03
        01
        040000000000000000000000000000000000000000004000000000000000050000000300
        
        ====字符串表====
        
        5B000000
        5F676C6F62616C5F756E696E745F76617200//_global_unint_var
        5F676C6F62616C5F696E745F76617200//_global_int_var
        3F7374617469635F766172403F313F3F6D61696E404039403900//?static_var@?1??main@@9@9
        3F7374617469635F76617232403F313F3F6D61696E404039403900//?static_var2@?1??main@@9@9
    • 数据结构
      • typedef struct _IMAGE_FILE_HEADER {
            WORD    Machine;
            WORD    NumberOfSections;
            DWORD   TimeDateStamp;
            DWORD   PointerToSymbolTable;
            DWORD   NumberOfSymbols;
            WORD    SizeOfOptionalHeader;
            WORD    Characteristics;
        } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
        
        typedef struct _IMAGE_SECTION_HEADER {
            BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
            union {
                    DWORD   PhysicalAddress;
                    DWORD   VirtualSize;
            } Misc;
            DWORD   VirtualAddress;
            DWORD   SizeOfRawData;
            DWORD   PointerToRawData;
            DWORD   PointerToRelocations;
            DWORD   PointerToLinenumbers;
            WORD    NumberOfRelocations;
            WORD    NumberOfLinenumbers;
            DWORD   Characteristics;
        } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
        
        typedef struct _IMAGE_RELOCATION {
            union {
                DWORD   VirtualAddress;
                DWORD   RelocCount;             
            };
            DWORD   SymbolTableIndex;
            WORD    Type;
        } IMAGE_RELOCATION;
        
        typedef struct _IMAGE_SYMBOL {
            union {
                BYTE    ShortName[8];
                struct {
                    DWORD   Short;     // if 0, use LongName
                    DWORD   Long;      // offset into string table
                } Name;
                PBYTE   LongName[2];
            } N;
            DWORD   Value;
            SHORT   SectionNumber;
            WORD    Type;
            BYTE    StorageClass;
            BYTE    NumberOfAuxSymbols;
        } IMAGE_SYMBOL;
    • 参考:
  • 相关阅读:
    org.springframework.transaction.CannotCreateTransactionException Could not open
    org.springframework.web.util.NestedServletException Handler processing failed; n
    SSM 后台封装的有值, 到前台打印的时候没有值
    javax.net.ssl.SSLHandshakeException sun.security.validator.ValidatorException PK
    a 链接点击下载
    form图片上传遇到错误
    forever 启动nodejs
    nodejs 新建项目
    nodejs 安装
    nodejs 爬虫模板 map&array 数据模型
  • 原文地址:https://www.cnblogs.com/dahai/p/2135828.html
Copyright © 2011-2022 走看看