PE结构-DOS头

Nayon

发布于 2023-04-13 15:40:48

1840

发布于 2023-04-13 15:40:48

文章被收录于专栏：内网安全学习笔记内网安全学习笔记

PE结构-DOS头，本部分为参照吾爱破解论坛lyl610abc师傅PE文件笔记所整理的学习笔记。

DOS部首

DOS部首结构

其结构分为两部分:

DOS ‘MZ’ HEADER 其在c中定义的结构体为_IMAGE_DOS_HEADER
DOS sub

DOS MZ头

DOS MZ头在C语言中所定义的结构体为:

定义于winnt.h

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (r  elative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;