DOS MZ HEADER

<IMAGE_DOS_HEADER>

IMAGE_DOS_HEADER <>
  - e_magic : <-- ce sont les deux premiers octets du prog (la signature MZ)
  - e_lflanew : <-- Offset du PE Header
IMAGE_DOS_HEADER ENDS
DOS STUB
Chaîne de caractères : "This Program Requires Windows"
ou : "This program cannot run in DOS mode"
PE HEADER <IMAGE_NT_HEADER>
IMAGE_NT_HEADER <>
  - Signature : <-- PE (ou 50h, 45h, 00h, 00h)
  - FileHeader IMAGE_FILE_HEADER <>
               - Machine *
               - NumberOfSections ***
               - TimeDateStamp
               - PointerToSymbolTable
               - NumberOfSymbols
               - SizeOfOptionalHeader
               IMAGE_FILE_HEADER ENDS      
  - OptionalHeader IMAGE_OPTIONAL_HEADER32 <>
               - AddressOfEntryPoint ***
               - ImageBase ***
               - SectionAlignment
               - FileAlignment
               - MajorSubSystemVersion
               - SizeOfImage
               - SubSystem
               - DataDirectory IMAGE_DATA_DIRECTORY <>				 				  
			       - Export symbols (IMAGE_DATA_DIRECTORY <> * 0)<--  Vers Table des Exportations
			       - Import symbols (IMAGE_DATA_DIRECTORY <> * 1)<--  Vers Table des Importations
			       - Resources      (IMAGE_DATA_DIRECTORY <> * 2)
			       - Exception      (IMAGE_DATA_DIRECTORY <> * 3)
			       - Security       (IMAGE_DATA_DIRECTORY <> * 4)
			       - Base relocation (IMAGE_DATA_DIRECTORY <> * 5)
			       - Debug          (IMAGE_DATA_DIRECTORY <> * 6)
			       - Copyright string (IMAGE_DATA_DIRECTORY <> * 7)
			       - Unknown        (IMAGE_DATA_DIRECTORY <> * 8)
			       - Thread local storage (TLS) (IMAGE_DATA_DIRECTORY <> * 9)
			       - Load configuration (IMAGE_DATA_DIRECTORY <> * 10)
			       - Bound Import   (IMAGE_DATA_DIRECTORY <> * 11)
			       - Import Address Table (IMAGE_DATA_DIRECTORY <> * 12)
			       - Delay Import   (IMAGE_DATA_DIRECTORY <> * 13)
			       - COM descriptor (IMAGE_DATA_DIRECTORY <> * 14)
			       IMAGE_DATA_DIRECTORY ENDS
               IMAGE_OPTIONAL_HEADER32 ENDS
IMAGE_NT_HEADER ENDS
TABLE DES SECTIONS
<IMAGE_SECTION_HEADER>

IMAGE_SECTION_HEADER <>
  - Name1 : <-- le nom de la section
  - VirtualAddress
  - SizeOfRawData
  - PointerToRelocation
  - PointerToLineNumbers
  - NumberOfRelocations
  - NumberOfLineNumbers
  - Characteristics
IMAGE_SECTION_HEADER ENDS

IMAGE_SECTION_HEADER <>
  - Name1 : <-- le nom de la section
  - VirtualAddress
  - SizeOfRawData
  - PointerToRelocation
  - PointerToLineNumbers
  - NumberOfRelocations
  - NumberOfLineNumbers
  - Characteristics
IMAGE_SECTION_HEADER ENDS

IMAGE_SECTION_HEADER <> 
  - .... Il y aura autant de fois de répétition de     
  - .... ces paramètres qu'il y a de sections dans notre programme.
  - .... Cette répétition est donc définit par
  - .... la valeur du membre 'NumberOfSections' se trouvant dans la
  - .... structure IMAGE_FILE_HEADER <> elle même
  - .... appartenant à la structure IMAGE_NT_HEADER <>
  - .... (le PE Header)
  - .... 
IMAGE_SECTION_HEADER ENDS 

IMAGE_SECTION_HEADER <>
  - Name1 : <-- le nom de la section
  - VirtualAddress
  - SizeOfRawData
  - PointerToRelocation
  - PointerToLineNumbers
  - NumberOfRelocations
  - NumberOfLineNumbers
  - Characteristics
IMAGE_SECTION_HEADER ENDS
SECTION 1
(EX: .DATA)
00401000h

Votre programme commence réellement à partir d'ici.

SECTION 2
(EX: .DATA?)
 
SECTION 3
....
 
SECTION 4
(EX: .CODE)
 


	   					  	 	 			 Synthétisé par Morgatte