zoukankan      html  css  js  c++  java
  • exe文件的内部结构

    http://www.nondot.org/sabre/os/files/Executables/EXE.txt
    offset  length  description                             comments
    ----------------------------------------------------------------------
    0       word    exe file signature                      usually 4d5a
    2       word    length of last used sector in file      modulo 512
    4       word    size of file, incl. header              in 512-pages
    6       word    number of relocation table items
    8       word    size of header                          in 16-byte paragraphs
    a       word    min. paragraphs needed above program    in 16-byte paragraphs
    c       word    max. paragraphs needen above program    in 16-byte paragraphs
    e       word    displacement of stack segment in module rel. to start of prog.
    10      word    contents of SP reg. at entry
    12      word    checksum                                2's complement
    14      word    contents of IP reg. at entry
    16      word    displacement of code module             rel. to start of prog.
    18      word    offset to first relocation item in file rel. to start of prog.
    1a      word    overlay number                          0 for resident prog.
    1c      varies  variable RESERVED place
    varies  varies  relocation table
    varies  varies  variable RESERVED place
    varies  varies  program and data space
    varies  varies  stack segment
    
    The relocation table is a set of far pointers (eg: 1234:5678h) and it appears
    you just add the relocation factor to the value at that address. The relocation
    factor is the start segment of where the program is loaded.
    
    Example:
    ------------------------------------------------
    code segment
    start:
            mov     ax,seg _myseg
    code ends
    
    _myseg segment
    _myseg ends
    end start
    -------------------------------------------------
    
     Start  Stop   Length Name               Class
    
     00000H 00002H 00003H CODE
     00010H 00010H 00000H _MYSEG
    
    -------------------------------------------------
    
    Note that _MYSEG is exactly one segment above CODE.
    
    Generated output is B8 01 00; which is "mov ax,0001"
    
    The fixup table for this file has a single entry, 0000:0001. Thus if the start
    of the program begins at segment 3562 then the "mov ax,0001" gets converted to
    "mov ax,3563".
    
  • 相关阅读:
    GDB的启动方式
    【linux】基础1
    web安全实战折腾系列-对应B站视频
    白帽子讲web安全笔记-对应B站视频
    DNF搬砖号打造【只适合100级的版本】
    阿里云的开发者社区测试
    OWASP安全测试指南-OTGv4
    第8章 VLAN
    web安全简介与环境配置-反射型XSS-存储型XSS-XSS进阶-sql注入基础
    xss攻防
  • 原文地址:https://www.cnblogs.com/jizha/p/2231131.html
Copyright © 2011-2022 走看看