PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
来源:互联网 发布:python粒子群算法 编辑:程序博客网 时间:2024/05/22 14:45
typedef struct _IMAGE_FILE_HEADER
{
+04hWORD Machine; // 运行平台+06h WORD NumberOfSections;// 文件的区块数目+08hDWORD TimeDateStamp;// 文件创建日期和时间+0Ch DWORD PointerToSymbolTable;// 指向符号表(主要用于调试)+10h DWORD NumberOfSymbols;// 符号表中符号个数(同上)+14h WORD SizeOfOptionalHeader;// IMAGE_OPTIONAL_HEADER32 结构大小+16h WORD Characteristics;// 文件属性} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
该结构如下图所示:
- IMAGE_FILE_MACHINE_I386
- 0x014c
x86
- IMAGE_FILE_MACHINE_IA64
- 0x0200
Intel Itanium
- IMAGE_FILE_MACHINE_AMD64
- 0x8664
x64
The characteristics of the image. This member can be one or more of the following values.
- IMAGE_FILE_RELOCS_STRIPPED
- 0x0001
Relocation information was stripped from the
file. The file must be loaded at its preferred
base address. If the base address is not
available, the loader reports an error.
- IMAGE_FILE_EXECUTABLE_IMAGE
- 0x0002
The file is executable (there are no unresolved
external references).
- IMAGE_FILE_LINE_NUMS_STRIPPED
- 0x0004
COFF line numbers were stripped from the
file.
- IMAGE_FILE_LOCAL_SYMS_STRIPPED
- 0x0008
COFF symbol table entries were stripped from
file.
- IMAGE_FILE_AGGRESIVE_WS_TRIM
- 0x0010
Aggressively trim the working set. This value is
obsolete as of Windows 2000.
- IMAGE_FILE_LARGE_ADDRESS_AWARE
- 0x0020
The application can handle addresses larger
than 2 GB.
- IMAGE_FILE_BYTES_REVERSED_LO
- 0x0080
The bytes of the word are reversed. This flag
is obsolete.
- IMAGE_FILE_32BIT_MACHINE
- 0x0100
The computer supports 32-bit words.
- IMAGE_FILE_DEBUG_STRIPPED
- 0x0200
Debugging information was removed and stored
separately in another file.
- IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
- 0x0400
If the image is on removable media, copy it to
and run it from the swap file.
- IMAGE_FILE_NET_RUN_FROM_SWAP
- 0x0800
If the image is on the network, copy it to and
run it from the swap file.
- IMAGE_FILE_SYSTEM
- 0x1000
The image is a system file.
- IMAGE_FILE_DLL
- 0x2000
The image is a DLL file. While it is an executable
file, it cannot be run directly.
- IMAGE_FILE_UP_SYSTEM_ONLY
- 0x4000
The file should be run only on a uniprocessor
computer.
- IMAGE_FILE_BYTES_REVERSED_HI
- 0x8000
The bytes of the word are reversed. This flag
is obsolete.
- PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 转载——小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用
- object c 中 retain 和copy的区别
- objective-c中property的属性
- 变形PE头添加节形式感染
- ios捕获异常
- 2012.02.04梅林水库游玩
- PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 设计模式之Command模式(学习笔记)
- C++内联函数(Inline)介绍
- 数据结构基础(1)-->双向链表
- 重装系统的方式和原理
- matlab 画圆~
- 在linux下安装was 6.1程序 Cannot get canonical host name for server
- 正则表达式解惑
- PE详解之IMAGE_OPTIONAL_HEADER32 结构定义即各个属性的作用(PE详解03)