查看Wireshark编译器版本

来源：互联网发布：linux系统启动不了编辑：程序博客网时间：2024/06/06 21:00

编译Wireshark插件，一般得与编译Wireshark的版本保持一致，这样才能直接将编译生成的dll插件放入Wireshark/plugins中后直接使用，而不用重新编译整个Wireshark。
Wireshark Version 1.10.1

1 使用PEiD确定

可以看到Linker Info为：10.0
VS的Linker版本对应关系为
VC6.0   :   6.0
VS2003 :   7.0
VS2005 :   8.0
VS2008 :   9.0
VS2010 :   10.0
VS2012 :   11.0
VS2013 :   12.0
所以可以确定Wireshark是由VS2010编译生成的

2 Linker Info的由来
PE结构中有两个字段MajorLinkerVersion,MinorLinkerVersion分别表示链接器的主副版本号，而这两个字段在IMAGE_OPTIONAL_HEADER结构中。
下面看下Wireshare.exe中的主副版本号是多少

2.1 PE结构

有关PE结构的定义在WINNT.h中，VC6的路径为D:\Program Files\Microsoft Visual Studio\VC98\Include

2.2 Wireshark前0x130字节内容

00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................00000030: 0000 0000 0000 0000 0000 0000 0801 0000  ................00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!..L.!Th00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS 00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......00000080: ef6e 031b ab0f 6d48 ab0f 6d48 ab0f 6d48  .n....mH..mH..mH00000090: a277 ee48 a90f 6d48 3841 f548 ad0f 6d48  .w.H..mH8A.H..mH000000a0: b092 f348 a10f 6d48 b092 c648 a90f 6d48  ...H..mH...H..mH000000b0: a277 e948 aa0f 6d48 b092 f148 b50f 6d48  .w.H..mH...H..mH000000c0: a277 fe48 be0f 6d48 ab0f 6c48 ca09 6d48  .w.H..mH..lH..mH000000d0: b092 c748 a00e 6d48 b092 f748 aa0f 6d48  ...H..mH...H..mH000000e0: ab0f fa48 aa0f 6d48 b092 f048 aa0f 6d48  ...H..mH...H..mH000000f0: 5269 6368 ab0f 6d48 0000 0000 0000 0000  Rich..mH........00000100: 0000 0000 0000 0000 5045 0000 4c01 0500  ........PE..L...00000110: 83cd f251 0000 0000 0000 0000 e000 2201  ...Q..........".00000120: 0b01 0a00 004c 1500 00da 1b00 0000 0000  .....L..........00000130: 7a34 1500 0010 0000 0060 1500 0000 4000  z4.......`....@.

2.3 DOS部首

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header    WORD   e_magic;                     // Magic number    WORD   e_cblp;                      // Bytes on last page of file    WORD   e_cp;                        // Pages in file    WORD   e_crlc;                      // Relocations    WORD   e_cparhdr;                   // Size of header in paragraphs    WORD   e_minalloc;                  // Minimum extra paragraphs needed    WORD   e_maxalloc;                  // Maximum extra paragraphs needed    WORD   e_ss;                        // Initial (relative) SS value    WORD   e_sp;                        // Initial SP value    WORD   e_csum;                      // Checksum    WORD   e_ip;                        // Initial IP value    WORD   e_cs;                        // Initial (relative) CS value    WORD   e_lfarlc;                    // File address of relocation table    WORD   e_ovno;                      // Overlay number    WORD   e_res[4];                    // Reserved words    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)    WORD   e_oeminfo;                   // OEM information; e_oemid specific    WORD   e_res2[10];                  // Reserved words    LONG   e_lfanew;                    // File address of new exe header  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

e_lfanew表示NT头的偏移
e_lfanew的偏移是60，而Whireshark.exe的60处的值为"08010000"=0x00000108（注：i386机器上整数存储是小端的）
也就是说NT头的文件偏移为0x108
注：可根据PE快速确定NT头位置

2.4 NT头

typedef struct _IMAGE_NT_HEADERS {    DWORD Signature;    IMAGE_FILE_HEADER FileHeader;    IMAGE_OPTIONAL_HEADER32 OptionalHeader;} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

2.4.1 IMAGE_FILE_HEADER

typedef struct _IMAGE_FILE_HEADER {    WORD    Machine;    WORD    NumberOfSections;    DWORD   TimeDateStamp;    DWORD   PointerToSymbolTable;    DWORD   NumberOfSymbols;    WORD    SizeOfOptionalHeader;    WORD    Characteristics;} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;#define IMAGE_SIZEOF_FILE_HEADER             20

2.4.2 IMAGE_OPTIONAL_HEADER

typedef struct _IMAGE_OPTIONAL_HEADER {    //    // Standard fields.    //    WORD    Magic;    BYTE    MajorLinkerVersion;    BYTE    MinorLinkerVersion;    DWORD   SizeOfCode;    DWORD   SizeOfInitializedData;    DWORD   SizeOfUninitializedData;    DWORD   AddressOfEntryPoint;    DWORD   BaseOfCode;    DWORD   BaseOfData;    //    // NT additional fields.    //    DWORD   ImageBase;    DWORD   SectionAlignment;    DWORD   FileAlignment;    WORD    MajorOperatingSystemVersion;    WORD    MinorOperatingSystemVersion;    WORD    MajorImageVersion;    WORD    MinorImageVersion;    WORD    MajorSubsystemVersion;    WORD    MinorSubsystemVersion;    DWORD   Win32VersionValue;    DWORD   SizeOfImage;    DWORD   SizeOfHeaders;    DWORD   CheckSum;    WORD    Subsystem;    WORD    DllCharacteristics;    DWORD   SizeOfStackReserve;    DWORD   SizeOfStackCommit;    DWORD   SizeOfHeapReserve;    DWORD   SizeOfHeapCommit;    DWORD   LoaderFlags;    DWORD   NumberOfRvaAndSizes;    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

2.5 LinkerVersion偏移
由以上结构可以看出，相对NT头偏移为：
MajorLinkerVersion offset = sizoef(Signature) + sizeof(IMAGE_FILE_HEADER) + 2 = 4 + 20 + 2 = 26 = 0x1a
MinorLinkerVersion offset = 4 + 20 + 3 = 27 = 0x1b

相对EXE文件偏移为：
MajorLinkerVersion offset = offsetof(NT) + 0x1a = 0x108 + 0x1a = 0x122
MinorLinkerVersion offset = offsetof(NT) + 0x1b = 0x108 + 0x1b = 0x123

可以看出主副版本分别是10(0xa),0(0x00)

3 About Wireshark
可以从Help->About Wireshark菜单直接看到编译版本信息

不过看PE文件内的链接器主副版本号更通用，可以看出未提供编译相关信息软件所使用VC的版本号