小甲魚在這里為大家做好了詳細的注釋,免得大家一頭霧水,另外可以結合小甲魚《加密系列》-系統篇-PE結構詳解視頻教程學習~若有紕漏之處還望大家不吝指正。
(注:最左邊是文件頭的偏移量。)
IMAGE_DOS_HEADER STRUCT
{
+0h WORD e_magic // Magic DOS signature MZ(4Dh 5Ah) DOS可執行文件標記
+2h WORD e_cblp // Bytes on last page of file
+4h WORD e_cp // Pages in file
+6h WORD e_crlc // Relocations
+8h WORD e_cparhdr // Size of header in paragraphs
+0ah WORD e_minalloc // Minimun extra paragraphs needs
+0ch WORD e_maxalloc // Maximun extra paragraphs needs
+0eh WORD e_ss // intial(relative)SS value DOS代碼的初始化堆棧SS
+10h WORD e_sp // intial SP value DOS代碼的初始化堆棧指針SP
+12h WORD e_csum // Checksum
+14h WORD e_ip // intial IP value DOS代碼的初始化指令入口[指針IP]
+16h WORD e_cs // intial(relative)CS value DOS代碼的初始堆棧入口
+18h WORD e_lfarlc // File Address of relocation table
+1ah WORD e_ovno // Overlay number
+1ch WORD e_res[4] // Reserved words
+24h WORD e_oemid // OEM identifier(for e_oeminfo)
+26h WORD e_oeminfo // OEM information;e_oemid specific
+29h WORD e_res2[10] // Reserved words
+3ch DWORD e_lfanew // Offset to start of PE header 指向PE文件頭
} IMAGE_DOS_HEADER ENDS