代码 |
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 4D 5A 00 5B D5 E2 C0 EF B6 BC C3 BB D3 C3 2C 2C MZ.[这里都没用,, 00000010 B1 C8 C8 E7 CE D2 D0 B4 3A CE D2 D2 B2 D6 BB 2C 比如我写:我也只, 00000020 CA C7 D2 BB B0 E3 CB A7 2C B2 BB CA C7 CC D8 2C 是一般帅,不是特,8 00000030 B1 F0 CB A7 B5 C4 C0 B2 5D 00 00 00 40 00 00 00 别帅的啦]...@... |
引用 |
+++++++++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++ + + +[PE标志][0x04] + + + +++++++++++++++++++++++++++++++++++++++ + + + <==PE信息部分 + +++++++++++++++++++++++++++++++++++++++ + + +[PE文件头][0x18] + + + +++++++++++++++++++++++++++++++++++++++ + + + + +++++++++++++++++++++++++++++++++++++++ + + +[自定义数据结构][0x0e] + + + +++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++++++++ |
代码 |
typedef struct _IMAGE_NT_HEADERS { DWORD Signature; //"PE标志"段,总是"PE00" IMAGE_FILE_HEADER FileHeader; //"PE文件头"段,指向IMAGE_FILE_HEADER结构 IMAGE_OPTIONAL_HEADER OptionalHeader; //"自定义数据"段,指向IMAGE_OPTIONAL_HEADER结构 } IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS; |
代码 |
typedef struct _IMAGE_FILE_HEADER { WORD Machine; //运行平台,386的话是104CH WORD NumberOfSections; //文件节数目,最少为2 DWORD TimeDateStamp; //文件创建时间,随便设置(不过为了最后生成方便,随便设置的地方最好都设置为0) DWORD PointerToSymbolTable; //这里两项记用于调试,也随便设置 DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; //下面那个IMAGE_OPTIONAL_HEADER结构的长度,一般为000EH(包括16个IMAGE_DATA_DIRECTORY结构),我们只要2个结构,所以设置为0070H WORD Characteristics; //文件属性,PE文件是010H,DLL的话是210H } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
代码 |
OptionHeader结构(自定义数据结构)定义如下: typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; //EXE文件的话这里是10B BYTE MajorLinkerVersion; //连接器版本,随便 BYTE MinorLinkerVersion; DWORD SizeOfCode; //所有代码节总大小,我们就一个节,所以是512,也就是200H DWORD SizeOfInitializedData; //....未初始化数据节....没有这个,设置为0 DWORD SizeOfUninitializedData; //....已................................ DWORD AddressOfEntryPoint; //代码执行起始地址,注意,这个是你代码存放的位置,[这里注意点1] DWORD BaseOfCode; //代码段......(这里三个都是内存地址),这里是0 DWORD BaseOfData; //数据段......(并非硬盘文件地址),这里是0 DWORD ImageBase; //建议加载位置,通常是00400000H,9X的系统可能略小于这个值,记不得了..:( DWORD SectionAlignment; //内存中对齐大小,一般为1000H,也就是NT的一个内存片,4KB DWORD FileAlignment; //文件..........,这里设置最小的,200H,兼容全部系统 WORD MajorOperatingSystemVersion; //一下几个都是系统版本相关的,随便设置 WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; //这里要设置为04H WORD MinorSubsystemVersion; DWORD Win32VersionValue; //未用 DWORD SizeOfImage; //PE文件占用的内存空间,我们设置为3000H DWORD SizeOfHeaders; //PE文件头大小(含节表),这里是200H DWORD CheckSum; //效验和(我不知道用来干嘛,PE几乎都是000000000,可能和其他方面有关,比如调试?) WORD Subsystem; //文件子系统,子系统的含义大家可以去参考NT内核,这里设置为02,03均可(控制台和窗口子系统) WORD DllCharacteristics; DWORD SizeOfStackReserve; //一下几个是有关堆和栈的设置,基本上随便,不过最好设置够用就行(不是0啊!) DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; //未用 DWORD NumberOfRvaAndSizes; //下面的IMAGE_DATA_DIRECTORY结构的数量,原来是16个,最少为2个 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER; |
代码 |
typedef struct _IMAGE_DATA_DIRECTORY { DWORD VirtualAddress; DWORD Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; |
代码 |
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000040 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 PE..L........... 00000050 00 00 00 00 70 00 0F 01 0B 01 00 00 00 02 00 00 ....p........... 00000060 00 00 00 00 00 00 00 00 79 01 00 00 00 00 00 00 ........y....... 00000070 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 ......@......... 00000080 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................ 00000090 00 30 00 00 00 02 00 00 00 00 00 00 02 00 00 00 .0.............. 000000A0 00 01 00 00 00 00 00 00 00 01 00 00 00 10 00 00 ................ 000000B0 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ 000000C0 28 11 00 00 28 00 00 00 |
引用 |
+++++++++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++ + + +[数据节表][0x24*N+1] + + + +++++++++++++++++++++++++++++++++++++++ + + + <==PE数据部分 + +++++++++++++++++++++++++++++++++++++++ + + +[数据节][不定] + + + +++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++++++++ |
代码 |
typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME];//这个8字节的空间就是给你来定义这个节的名称,比如大家常见的".text .data .code"等等,我这里为了以后的填充方便,设置了空白..(00000000H),其实这里是可以随便写的,比如你定义".zvrop"也可以 union { DWORD PhysicalAddress; //这是个联合结构,说明了该节的大小,我们整个PE文件就是一个节,所以是200H DWORD VirtualSize; } Misc; DWORD VirtualAddress; //定位该节在内存中的地址(相对于加载位置的偏移地址)我们这里是先不说这些.[这里算作注意点3] DWORD SizeOfRawData; //文件中的尺寸,这里和上面的联合结构不同,这里是对齐后的地址,我们设置为200H DWORD PointerToRawData; //该节在文件中的位置,相对于文件头,这里可以随便设置,不过设置了后面的代码指针也要跟着变动,我们这里设置100H DWORD PointerToRelocations; //下面四个是给连接器用的参数,随便 DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics; //节的属性,自己区查表,基于篇幅,这张表我就不提供了,需要的可以PM我,一般代码节为60000020H(40000000&2000000&00000020),即是可执行,可读的代码段,我们设置为60000060H,因为我们既包含了数据又包含了代码. } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; |
代码 |
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00 00 00 00 00 00 00 00 (...(........... 000000D0 00 02 00 00 00 10 00 00 00 02 00 00 00 01 00 00 ................ 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 ............`..` 000000F0 00 00 00 00 00 00 00 00 02 00 00 00 00 20 00 00 ............. .. 00000100 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000110 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 ....`..`........ |
代码 |
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000120 58 11 00 00 00 00 00 00 50 11 00 00 00 00 00 00 X.......P....... 00000130 00 00 00 00 6E 11 00 00 20 11 00 00 00 00 00 00 ....n... ....... 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000150 58 11 00 00 00 00 00 00 |
代码 |
typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; DWORD OriginalFirstThunk; //指向一个"函数列表的指针结构". }; DWORD TimeDateStamp; //暂时可以看作没用,0 DWORD ForwarderChain; //暂时可以看作没用,0 DWORD Name; //指向一个DLL,这个结构里面的函数必须都是这个DLL里面的 DWORD FirstThunk; //指向一个IAT表,最后操作系统修改的就是这个 } IMAGE_IMPORT_DESCRIPTOR; |
代码 |
typedef struct _IMAGE_THUNK_DATA32 { union { PBYTE ForwarderString; PDWORD Function; DWORD Ordinal; PIMAGE_IMPORT_BY_NAME AddressOfData; } u1; } IMAGE_THUNK_DATA32; |
代码 |
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 50 11 00 00 00 00 00 00 X.......P....... 00000130 00 00 00 00 6E 11 00 00 20 11 00 00 |