PE手工分析-PE头

要分析PE文件我们首先要对PE结构有一个大致的了解,大体上PE结构可以看成是一个平面空间里面包含有如下内容



相应的MSDOS头结构定义如下,Windows加载器在加载的过程中会判断dos头是否合法

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header

WORD   e_magic;                     // Magic number

WORD   e_cblp;                      // Bytes on last page of file

WORD   e_cp;                        // Pages in file

WORD   e_crlc;                      // Relocations

WORD   e_cparhdr;                   // Size of header in paragraphs

WORD   e_minalloc;                  // Minimum extra paragraphs needed

WORD   e_maxalloc;                  // Maximum extra paragraphs needed

WORD   e_ss;                        // Initial (relative) SS value

WORD   e_sp;                        // Initial SP value

WORD   e_csum;                      // Checksum

WORD   e_ip;                        // Initial IP value

WORD   e_cs;                        // Initial (relative) CS value

WORD   e_lfarlc;                    // File address of relocation table

WORD   e_ovno;                      // Overlay number

WORD   e_res[4];                    // Reserved words

WORD   e_oemid;                     // OEM identifier (for e_oeminfo)

WORD   e_oeminfo;                   // OEM information; e_oemid specific

WORD   e_res2[10];                  // Reserved words

LONG   e_lfanew;                    // File address of new exe header

} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

通过以上结构我们可以看到e_lfanew(60=0x3c个字节偏移)字段代表exe头在文件中的位置(00F8)



所以可以断定00F8位置指向的内容为PE头结构定义如下

typedef struct _IMAGE_NT_HEADERS {

DWORD Signature;                                                      //PE头签名PE\0\0

IMAGE_FILE_HEADER FileHeader;                          //PE文件头

IMAGE_OPTIONAL_HEADER32 OptionalHeader;    //PE扩展头

} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

0xF9=50 45 00 00=PE\0\0->Signature签字段

000000fch=镜像头结构开发位置占20个字节

typedef struct _IMAGE_FILE_HEADER {

WORD    Machine;                                                     //014C-IMAGE_FILE_MACHINE_I386

WORD    NumberOfSections;                                 //PE节数量-0007个节

DWORD   TimeDateStamp;                                        //时间戳E72B4FA9

DWORD   PointerToSymbolTable;                         //指向符号表0000

DWORD   NumberOfSymbols;                                    //符号表数量0000

WORD    SizeOfOptionalHeader;                         //扩展PE头大小00E0

WORD    Characteristics;                                    //文件属性0102-IMAGE_FILE_32BIT_MACHINE|IMAGE_FILE_EXECUTABLE_IMAGE

} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

00000110h=扩展文件头起始位置占224个字节(E0)

typedef struct _IMAGE_OPTIONAL_HEADER {

//

// Standard fields.

//

WORD    Magic;                                                     //010B-IMAGE_NT_OPTIONAL_HDR32_MAGIC

BYTE    MajorLinkerVersion;                         //0A-连接器主版本号

BYTE    MinorLinkerVersion;                         //00-连接器小版本号

DWORD   SizeOfCode;                                           //0000008A(138)-代码节大小

DWORD   SizeOfInitializedData;                    //0000004C(76)-已初始化数据大小

DWORD   SizeOfUninitializedData;                //00000000(0)-为初始化数据大小

DWORD   AddressOfEntryPoint;                         //000110AA程序入口地址

DWORD   BaseOfCode;                                             //00001000程序段基地址

DWORD   BaseOfData;                                             //00001000数据段基地址

//

// NT additional fields.

//

DWORD   ImageBase;                                                     //镜像加载基地址00400000

DWORD   SectionAlignment;                                     //节对其0001000(4096)

DWORD   FileAlignment;                                            //文件对齐0000200(512)

WORD    MajorOperatingSystemVersion;             //操作系统主版本号0005

WORD    MinorOperatingSystemVersion;             //操作系统小版本号0001

WORD    MajorImageVersion;                                   //镜像主版本号0000

WORD    MinorImageVersion;                                   //镜像小版本号0000

WORD    MajorSubsystemVersion;                           //子系统主版本号0005

WORD    MinorSubsystemVersion;                            //子系统小版本号0001

DWORD   Win32VersionValue;                                     //0

DWORD   SizeOfImage;                                                   //镜像大小00022000

DWORD   SizeOfHeaders;                                             //头大小0400

DWORD   CheckSum;                                                     //0

WORD    Subsystem;                                                   //03-IMAGE_SUBSYSTEM_WINDOWS_CUI

WORD    DllCharacteristics;                               //8140IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

DWORD   SizeOfStackReserve;                               //栈初始化大小010000

DWORD   SizeOfStackCommit;                                 //栈提交大小01000

DWORD   SizeOfHeapReserve;                                  //堆初始化大小010000

DWORD   SizeOfHeapCommit;                                    //堆提交大小01000

DWORD   LoaderFlags;                                                //0

DWORD   NumberOfRvaAndSizes;                               //10(16)

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];//数据目录表

} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

到这里我们基本上已经将PE文件头信息给分析完成了.

下一篇我们来了解一下《导入表和函数地址导入表》