zoukankan      html  css  js  c++  java
  • exe文件的内部结构

    http://www.nondot.org/sabre/os/files/Executables/EXE.txt
    offset  length  description                             comments
    ----------------------------------------------------------------------
    0       word    exe file signature                      usually 4d5a
    2       word    length of last used sector in file      modulo 512
    4       word    size of file, incl. header              in 512-pages
    6       word    number of relocation table items
    8       word    size of header                          in 16-byte paragraphs
    a       word    min. paragraphs needed above program    in 16-byte paragraphs
    c       word    max. paragraphs needen above program    in 16-byte paragraphs
    e       word    displacement of stack segment in module rel. to start of prog.
    10      word    contents of SP reg. at entry
    12      word    checksum                                2's complement
    14      word    contents of IP reg. at entry
    16      word    displacement of code module             rel. to start of prog.
    18      word    offset to first relocation item in file rel. to start of prog.
    1a      word    overlay number                          0 for resident prog.
    1c      varies  variable RESERVED place
    varies  varies  relocation table
    varies  varies  variable RESERVED place
    varies  varies  program and data space
    varies  varies  stack segment
    
    The relocation table is a set of far pointers (eg: 1234:5678h) and it appears
    you just add the relocation factor to the value at that address. The relocation
    factor is the start segment of where the program is loaded.
    
    Example:
    ------------------------------------------------
    code segment
    start:
            mov     ax,seg _myseg
    code ends
    
    _myseg segment
    _myseg ends
    end start
    -------------------------------------------------
    
     Start  Stop   Length Name               Class
    
     00000H 00002H 00003H CODE
     00010H 00010H 00000H _MYSEG
    
    -------------------------------------------------
    
    Note that _MYSEG is exactly one segment above CODE.
    
    Generated output is B8 01 00; which is "mov ax,0001"
    
    The fixup table for this file has a single entry, 0000:0001. Thus if the start
    of the program begins at segment 3562 then the "mov ax,0001" gets converted to
    "mov ax,3563".
    
  • 相关阅读:
    12. nc/netcat 用法举例
    7. 由一道ctf学习变量覆盖漏洞
    11. 几点基于Web日志的Webshell检测思路
    约瑟夫环
    栈结构的经典算法题
    二叉查找树之二
    fork与vfork
    数组常见算法题
    赛马问题
    fibonacci 数列及其应用
  • 原文地址:https://www.cnblogs.com/jizha/p/2231131.html
Copyright © 2011-2022 走看看