windows PE 格式

memetao 于 2023-01-14 发布

PE

全文翻译摘抄自: https://0xrick.github.io/categories/#win-internals

PE (Portable Execute) 是可执行文件的一个总称,DLL,EXE等，专指32位可执行文件，64位的叫做PE+\PE32+,是一种扩展格式。

文件结构如下所示: PE

实在是复杂, 从上到下又分为 DOS头，NT头，节表以及具体的节，如下 PE.

接下来是NT HEADER， 又分为好几个， 我们先用PE-bear打开一个exe瞧一眼 PE

接下来是SectionTable:

he section table follows the Optional Header immediately, it is an array of Image Section Headers, there’s a section header for every section in the PE file. Each header contains information about the section it refers to.

Section:

Sections are where the actual contents of the file are stored, these include things like data and resources that the program uses, and also the actual code of the program, there are several sections each one with its own purpose.

DOS HEADER

PE 文件中的前64字节, 在现代windows中已经不重要, 主要是”向后兼容(backward compatibility)”。

有了这64字节, PE就能够在DOS环境下执行(没试过，难以置信)。

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

对PE loader来说, 有些字段没那么重要。

e_lfanew: it holds an offset to the start of the NT headers. 很重要, PE-Loader需要根据这个值去找 file header.

DOS Stub

是一段DOS程序, 打印” the executable is not compatible with DOS”然后退出。

NT Headers

分为64位和32位:

typedef struct _IMAGE_NT_HEADERS64 {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

### Signatrue

4字节, 0x50450000, PE\0\0 in ASCII.

File Header

定义如下:

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

Optional Header

非常重要的一个部分，分为32和64两个版本:

typedef struct _IMAGE_OPTIONAL_HEADER {
    //..
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

typedef struct _IMAGE_OPTIONAL_HEADER64 {
    // 略
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;

导入表和导出表

导入表结构