DOS MZ HEADER <IMAGE_DOS_HEADER> |
IMAGE_DOS_HEADER <>
- e_magic : <-- ce sont les deux premiers octets du prog (la signature MZ)
- e_lflanew : <-- Offset du PE Header
IMAGE_DOS_HEADER ENDS
|
DOS STUB
|
Chaîne de caractères : "This Program Requires Windows"
ou : "This program cannot run in DOS mode"
|
PE HEADER
<IMAGE_NT_HEADER>
|
IMAGE_NT_HEADER <> - Signature : <-- PE (ou 50h, 45h, 00h, 00h) - FileHeader IMAGE_FILE_HEADER <> - Machine * - NumberOfSections *** - TimeDateStamp - PointerToSymbolTable - NumberOfSymbols - SizeOfOptionalHeader IMAGE_FILE_HEADER ENDS - OptionalHeader IMAGE_OPTIONAL_HEADER32 <> - AddressOfEntryPoint *** - ImageBase *** - SectionAlignment - FileAlignment - MajorSubSystemVersion - SizeOfImage - SubSystem - DataDirectory IMAGE_DATA_DIRECTORY <> - Export symbols (IMAGE_DATA_DIRECTORY <> * 0)<-- Vers Table des Exportations - Import symbols (IMAGE_DATA_DIRECTORY <> * 1)<-- Vers Table des Importations - Resources (IMAGE_DATA_DIRECTORY <> * 2) - Exception (IMAGE_DATA_DIRECTORY <> * 3) - Security (IMAGE_DATA_DIRECTORY <> * 4) - Base relocation (IMAGE_DATA_DIRECTORY <> * 5) - Debug (IMAGE_DATA_DIRECTORY <> * 6) - Copyright string (IMAGE_DATA_DIRECTORY <> * 7) - Unknown (IMAGE_DATA_DIRECTORY <> * 8) - Thread local storage (TLS) (IMAGE_DATA_DIRECTORY <> * 9) - Load configuration (IMAGE_DATA_DIRECTORY <> * 10) - Bound Import (IMAGE_DATA_DIRECTORY <> * 11) - Import Address Table (IMAGE_DATA_DIRECTORY <> * 12) - Delay Import (IMAGE_DATA_DIRECTORY <> * 13) - COM descriptor (IMAGE_DATA_DIRECTORY <> * 14) IMAGE_DATA_DIRECTORY ENDS IMAGE_OPTIONAL_HEADER32 ENDS IMAGE_NT_HEADER ENDS |
TABLE DES SECTIONS
<IMAGE_SECTION_HEADER> |
IMAGE_SECTION_HEADER <> - Name1 : <-- le nom de la section - VirtualAddress - SizeOfRawData - PointerToRelocation - PointerToLineNumbers - NumberOfRelocations - NumberOfLineNumbers - Characteristics IMAGE_SECTION_HEADER ENDS IMAGE_SECTION_HEADER <> - Name1 : <-- le nom de la section - VirtualAddress - SizeOfRawData - PointerToRelocation - PointerToLineNumbers - NumberOfRelocations - NumberOfLineNumbers - Characteristics IMAGE_SECTION_HEADER ENDS IMAGE_SECTION_HEADER <> - .... Il y aura autant de fois de répétition de - .... ces paramètres qu'il y a de sections dans notre programme. - .... Cette répétition est donc définit par - .... la valeur du membre 'NumberOfSections' se trouvant dans la - .... structure IMAGE_FILE_HEADER <> elle même - .... appartenant à la structure IMAGE_NT_HEADER <> - .... (le PE Header) - .... IMAGE_SECTION_HEADER ENDS IMAGE_SECTION_HEADER <> - Name1 : <-- le nom de la section - VirtualAddress - SizeOfRawData - PointerToRelocation - PointerToLineNumbers - NumberOfRelocations - NumberOfLineNumbers - Characteristics IMAGE_SECTION_HEADER ENDS |
SECTION 1
(EX: .DATA) |
00401000h
Votre programme commence réellement à partir d'ici. |
SECTION 2
(EX: .DATA?) |
|
SECTION 3
.... |
|
SECTION 4
(EX: .CODE) |
Synthétisé par Morgatte