#define IMAGE_SIZEOF_SHORT_NAME 8 typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD VirtualSize; } Misc; DWORD VirtualAddress; DWORD SizeOfRawData; DWORD PointerToRawData; DWORD PointerToRelocations; DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_S..
COFF Optional Header의 확장으로 윈도우의 링커나 로더가 요구하는 부가적인 정보를 담고있다. typedef struct _IMAGE_OPTIONAL_HEADER64 { // Standard fields. WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; // NT additional fields. ULONGLONG ImageBase; DWORD SectionAlignment; DWORD FileAlignment; ..
typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics; } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; IMAGE_FILE_HEADER 의 크기는 20bytes 로 WinNT.h 파일에 정의되어있으며 32비트, 64비트 모두 동일하다. 1. Machine PE파일의 CPU ID를 나타내는 시그니쳐로, WinNT.h 파일 내에 #define 을 통해 다양한 CPU ID들이 정의되어있다. 이 필..
typedef struct _IMAGE_NT_HEADERS64 { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER64 OptionalHeader; } IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; typedef struct _IMAGE_NT_HEADERS32 { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader; } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; IMAGE_NT_HEADERS 는 32비트와 64비트로 나뉘며, 실질적인 차이는 OptionalHeader 필드..
typedef struct _IMAGE_DOS_HEADER // DOS .EXE header { WORD e_majic;// Magic number WORD e_cblp;// Bytes on last page of file WORD e_cp;// Pages in file WORD e_crlc;// Relocations WORD e_cparhdr;// Size of header in paragraphs WORD e_minalloc;// Minimum extra paragraphs needed WORD e_maxalloc;// Maximun extra paragraphs needed WORD e_ss;// Initial (relative) SS value WORD e_sp;// Initial SP value..
