小甲魚PE詳解之IMAGE_DOS_HEADER結構定義即各個屬性的作用(PE詳解01)
(注:最左邊是文件頭的偏移量。)
IMAGE_DOS_HEADER STRUCT
{
+0h
WORD
e_magic //
Magic DOS signature MZ(4Dh 5Ah) DOS可執行文件標記
+2h
WORD e_cblp
// Bytes on last page of file
+4h
WORD e_cp
// Pages in file
+6h
WORD e_crlc
// Relocations
+8h
WORD e_cparhdr //
Size of header in paragraphs
+0ah
WORD e_minalloc //
Minimun extra paragraphs needs
+0ch
WORD e_maxalloc //
Maximun extra paragraphs needs
+0eh
WORD e_ss
// intial(relative)SS value
DOS代碼的初始化堆棧SS
+10h
WORD e_sp
// intial SP value
DOS代碼的初始化堆棧指針SP
+12h
WORD e_csum
// Checksum
+14h
WORD e_ip
// intial IP value
DOS代碼的初始化指令入口[指針IP]
+16h
WORD e_cs
// intial(relative)CS value DOS代碼的初始堆棧入口
+18h
WORD e_lfarlc
// File Address of relocation table
+1ah
WORD
e_ovno // Overlay number
+1ch
WORD e_res[4]
// Reserved words
+24h
WORD e_oemid
// OEM identifier(for e_oeminfo)
+26h
WORD e_oeminfo // OEM information;e_oemid specific
+29h
WORD e_res2[10] // Reserved words
+3ch
DWORD e_lfanew //
Offset to start of PE header 指向PE文件頭
} IMAGE_DOS_HEADER ENDS
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.