PE
来源:互联网 发布:java全文检索 编辑:程序博客网 时间:2024/04/26 21:41
Tutorial 1: Overview of PE file format
If we view the PE file format as a logical disk, the PE header as the boot sector and the sections as files, we still don't have enough information to find out where the files reside on the disk, ie. we haven't discussed the directory equivalent of the PE file format. Immediately following the PE header is the section table which is an array of structures. Each structure contains the information about each section in the PE file such as its attribute, the file offset, virtual offset. If there are 5 sections in the PE file, there will be exactly 5 members in this structure array. We can then view the section table as the root directory of the logical disk. Each member of the array is equvalent to the each directory entry in the root directory.
The section table of this file looks like the following:
SectionVirtual SizeVirtual OffsetRaw SizeRaw OffsetCharacteristics.text0000024C00001000000004000000040060000020.rdata000001DC00002000000002000000080040000040.data000000E0000030000000020000000A00C0000040
That's all about the physical layout of the PE file format. I'll summarize the major steps in loading a PE file into memory below:
- When the PE file is run, the PE loader examines the DOS MZ header for the offset of the PE header. If found, it skips to the PE header.
- The PE loader checks if the PE header is valid. If so, it goes to the end of the PE header.
- Immediately following the PE header is the section table. The PE header reads information about the sections and maps those sections into memory using file mapping. It also gives each section the attributes as specified in the section table.
- After the PE file is mapped into memory, the PE loader concerns itself with the logical parts of the PE file, such as the import table.
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE
- PE文件-PE文件格式
- PE和动态PE
- PE文件格式
- PE文件格式
- PE学习
- PE文件格式
- ios学习笔记之UI篇(六):多视图应用程序
- hive sql执行计划树解析
- 黑马程序员 面向对象(上)
- 揭开Socket编程的面纱
- keyCode键码表
- PE
- MapReduce 中的两表 join 几种方案简介
- 将用DataSet获取所有的数据存入数组中去
- eclipese安装pydev(解决不显示pydev的设置项)
- Storm中Topology的状态
- Android Smart Image View
- Listener监听器一
- 关于kamailio-4.0.3版本,内存分配
- python之列表(list),元组(tuple),集合(set),字典(dict)