zoukankan      html  css  js  c++  java
  • [PE格式分析] 2.IMAGE_DOS_HEADER

    typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
        WORD   e_magic;                     // Magic number 固定为"MZ" 即, 4Dh 5Ah
        WORD   e_cblp;                      // Bytes on last page of file
        WORD   e_cp;                        // Pages in file
        WORD   e_crlc;                      // Relocations
        WORD   e_cparhdr;                   // Size of header in paragraphs
        WORD   e_minalloc;                  // Minimum extra paragraphs needed
        WORD   e_maxalloc;                  // Maximum extra paragraphs needed
        WORD   e_ss;                        // Initial (relative) SS value
        WORD   e_sp;                        // Initial SP value
        WORD   e_csum;                      // Checksum
        WORD   e_ip;                        // Initial IP value
        WORD   e_cs;                        // Initial (relative) CS value
        WORD   e_lfarlc;                    // File address of relocation table
        WORD   e_ovno;                      // Overlay number
        WORD   e_res[4];                    // Reserved words
        WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
        WORD   e_oeminfo;                   // OEM information; e_oemid specific
        WORD   e_res2[10];                  // Reserved words
        LONG   e_lfanew;                    // File address of new exe header 指向PE头
      } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

    对于我们来说,有用的只有两个数据,一个是 e_magic 固定为 “MZ”,另外一个是最后的 e_lfanew ,指向pe头

    看以下实例:

    实例1

  • 相关阅读:
    [APIO2014]序列分割
    [HNOI2014]世界树
    [THUWC2017]随机二分图
    快乐游戏鸡
    [SHOI2014]三叉神经树
    带花树学习笔记
    最小树形图——朱刘算法学习笔记
    【WC2018】即时战略
    [HNOI2015]接水果
    [HAOI2018]染色
  • 原文地址:https://www.cnblogs.com/night-ride-depart/p/5769475.html
Copyright © 2011-2022 走看看