zoukankan      html  css  js  c++  java
  • exe文件的内部结构

    http://www.nondot.org/sabre/os/files/Executables/EXE.txt
    offset  length  description                             comments
    ----------------------------------------------------------------------
    0       word    exe file signature                      usually 4d5a
    2       word    length of last used sector in file      modulo 512
    4       word    size of file, incl. header              in 512-pages
    6       word    number of relocation table items
    8       word    size of header                          in 16-byte paragraphs
    a       word    min. paragraphs needed above program    in 16-byte paragraphs
    c       word    max. paragraphs needen above program    in 16-byte paragraphs
    e       word    displacement of stack segment in module rel. to start of prog.
    10      word    contents of SP reg. at entry
    12      word    checksum                                2's complement
    14      word    contents of IP reg. at entry
    16      word    displacement of code module             rel. to start of prog.
    18      word    offset to first relocation item in file rel. to start of prog.
    1a      word    overlay number                          0 for resident prog.
    1c      varies  variable RESERVED place
    varies  varies  relocation table
    varies  varies  variable RESERVED place
    varies  varies  program and data space
    varies  varies  stack segment
    
    The relocation table is a set of far pointers (eg: 1234:5678h) and it appears
    you just add the relocation factor to the value at that address. The relocation
    factor is the start segment of where the program is loaded.
    
    Example:
    ------------------------------------------------
    code segment
    start:
            mov     ax,seg _myseg
    code ends
    
    _myseg segment
    _myseg ends
    end start
    -------------------------------------------------
    
     Start  Stop   Length Name               Class
    
     00000H 00002H 00003H CODE
     00010H 00010H 00000H _MYSEG
    
    -------------------------------------------------
    
    Note that _MYSEG is exactly one segment above CODE.
    
    Generated output is B8 01 00; which is "mov ax,0001"
    
    The fixup table for this file has a single entry, 0000:0001. Thus if the start
    of the program begins at segment 3562 then the "mov ax,0001" gets converted to
    "mov ax,3563".
    
  • 相关阅读:
    支付宝沙箱测试
    SQLServer2012书学习结束
    SQLServer2012书学习十 十一 十二 存储过程、触发器、游标
    SQLServer2012书学习七八九 统计数据、视图、索引
    SQLServer2012书学习第五六
    一些工具的定义
    SQLServer2012书学习第四章
    SQLServer2012书学习
    SqlServer文件组
    数据库硬盘满了如何清空数据库日志
  • 原文地址:https://www.cnblogs.com/jizha/p/2231131.html
Copyright © 2011-2022 走看看