PE 6.0 格式研究

PE6.0格式研究 (5)

作者:陆麟
转载请征得作者同意.
1999.9.12

PE分析被拖延了一段时间(给女朋友闹的:-)).今天又开始了.
完整的PE32或PE32+可选头结构如下.
typedef struct {
_CommOptHead CommOptHead;
unsigned __int64 SizeOfStackReserve;
unsigned __int64 SizeOfStackCommit;
unsigned __int64 SizeOfHeapReserve;
unsigned __int64 SizeOfHeapCommit;
DWORD USELESS;
DWORD NumberOfDataEntry;
_IMG_DATA_DIR ImgDataDir[0]; //Do remember ImgDataDir
        //probably doesn't contents
        //16 entries. The number of
        //entery depends on field
        //NumberOfDataEntry
}OptHead64,*pOptHead64;

typedef struct {
_CommOptHead CommOptHead;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD USELESS;
DWORD NumberOfDataEntry;
_IMG_DATA_DIR ImgDataDir[0];
}OptHead32,*pOptHead32;

OptHead64是PE32+的可选头结构.另一个是PE32的.里面也没什么可以多解释的了.
_IMG_DATA_DIR结构如下.
typedef struct {
PEIMAGE_DATA_DIRECTORY ExpTbl; //Export Table RVA and size
PEIMAGE_DATA_DIRECTORY ImpTbl; //Import ..................
PEIMAGE_DATA_DIRECTORY ResTbl; //Resources ...............
PEIMAGE_DATA_DIRECTORY ExcptTbl; //Execption ...........
PEIMAGE_DATA_DIRECTORY CrtfTbl; //Certificate .........
PEIMAGE_DATA_DIRECTORY BaseRelocTbl;
PEIMAGE_DATA_DIRECTORY DbgTbl;
PEIMAGE_DATA_DIRECTORY Architecture;
PEIMAGE_DATA_DIRECTORY GlobalPtr;
PEIMAGE_DATA_DIRECTORY TlsTbl;
PEIMAGE_DATA_DIRECTORY LoadConfigTbl;
PEIMAGE_DATA_DIRECTORY BoundImpTbl;
PEIMAGE_DATA_DIRECTORY IAT; //Import Address ..........
PEIMAGE_DATA_DIRECTORY DelayImpDes;
PEIMAGE_DATA_DIRECTORY COMRT_H; //COM+ runtime header..
PEIMAGE_DATA_DIRECTORY RESERVED;
}_IMG_DATA_DIR,*pIMG_DATA_DIR;
由于没有硬性规定_IMG_DATA_DIR一定要含有16个PEIMAGE_DATA_DIRECTORY结构.所以真正的PEIMAGE_DATA_DIRECTORY数目一定是按照NumberOfDataEntry来的.如果NumberOfDataEntry显示数字是8,那么8个PEIMAGE_DATA_DIRECTORY之后就是其他数据结构了.但是,目前所有的LINKER都将NumberOfDataEntry设置为16,所以,我在PE32X的OPTNL头文件里提供的数据还是一个_IMG_DATA_DIR结构.但长度为0.
经管没有PEIMAGE_DATA_DIRECTORY数量的规定,但是_IMG_DATA_DIR结构里的PEIMAGE_DATA_DIRECTORY出现的顺序却是有规矩的.规矩就如上.第一个代表引出表,第二个代表引入表等等.每个PEIMAGE_DATA_DIRECTORY的结构如下.
typedef struct {
DWORD RVA;
DWORD SIZE;
}PEIMAGE_DATA_DIRECTORY,*pPEIMAGE_DATA_DIRECTORY;

这回就说到这里,且听下会分解.