小甲鱼PE详解之IMAGE_DOS_HEADER结构定义即各个属性的作用(PE详解01)
2016-07-21 14:17
597 查看
(注:最左边是文件头的偏移量。)
IMAGE_DOS_HEADER STRUCT
{
+0hWORD
e_magic //
Magic DOS signature MZ(4Dh 5Ah) DOS可执行文件标记
+2h WORD e_cblp //
Bytes on last page of file
+4hWORD e_cp //
Pages in file
+6hWORD e_crlc //
Relocations
+8hWORD e_cparhdr //Size
of header in paragraphs
+0ahWORD e_minalloc //Minimun extra paragraphs needs
+0chWORD e_maxalloc //Maximun
extra paragraphs needs
+0ehWORD e_ss //
intial(relative)SS value DOS代码的初始化堆栈SS
+10hWORD e_sp
// intial SP value DOS代码的初始化堆栈指针SP
+12hWORD e_csum
// Checksum
+14hWORD e_ip
// intial IP value DOS代码的初始化指令入口[指针IP]
+16hWORD e_cs
// intial(relative)CS value DOS代码的初始堆栈入口
+18hWORD e_lfarlc
// File Address of relocation table
+1ahWORD e_ovno
// Overlay number
+1chWORD e_res[4]
// Reserved words
+24hWORD e_oemid
// OEM identifier(for e_oeminfo)
+26hWORD e_oeminfo // OEM information;e_oemid specific
+29hWORD e_res2[10] // Reserved words
+3chDWORD e_lfanew //Offset to start of PE
header 指向PE文件头
} IMAGE_DOS_HEADER ENDS
IMAGE_DOS_HEADER STRUCT
{
+0hWORD
e_magic //
Magic DOS signature MZ(4Dh 5Ah) DOS可执行文件标记
+2h WORD e_cblp //
Bytes on last page of file
+4hWORD e_cp //
Pages in file
+6hWORD e_crlc //
Relocations
+8hWORD e_cparhdr //Size
of header in paragraphs
+0ahWORD e_minalloc //Minimun extra paragraphs needs
+0chWORD e_maxalloc //Maximun
extra paragraphs needs
+0ehWORD e_ss //
intial(relative)SS value DOS代码的初始化堆栈SS
+10hWORD e_sp
// intial SP value DOS代码的初始化堆栈指针SP
+12hWORD e_csum
// Checksum
+14hWORD e_ip
// intial IP value DOS代码的初始化指令入口[指针IP]
+16hWORD e_cs
// intial(relative)CS value DOS代码的初始堆栈入口
+18hWORD e_lfarlc
// File Address of relocation table
+1ahWORD e_ovno
// Overlay number
+1chWORD e_res[4]
// Reserved words
+24hWORD e_oemid
// OEM identifier(for e_oeminfo)
+26hWORD e_oeminfo // OEM information;e_oemid specific
+29hWORD e_res2[10] // Reserved words
+3chDWORD e_lfanew //Offset to start of PE
header 指向PE文件头
} IMAGE_DOS_HEADER ENDS
相关文章推荐
- js 对cookie的设置、删除、管理
- 自定义控件之重写ScrollView实现图片下拉放大
- 高德地图设置当前地图的经纬度范围
- 重写navagationBar.backBarbuttonItem的返回方法
- js——getElementBy
- Hadoop分布式文件系统HDFS的工作原理
- 多校比赛—It's All In The Mind
- 实习项目总结
- ECMAScript 6 扫盲
- 小白开始自己解决问题了吼吼~
- POJ1631——Bridging signals(动态规划,最长上升子序列应用)
- linux mmap 内存映射【转】
- iOS 跳转至AppStore评分页面
- 地图
- PHP函数篇详解十进制、二进制、八进制和十六进制转换函数说明
- Android自定义流式标签控件
- configure,make,make intall
- day2 HDU - 2899
- Android原生应用集成ReactNative坑总结
- RSA加密算法及其与SpringMVC集成