A preliminary study on the format of PE file by means of graphic tools

Tools:

Petool,minihex,peviewer

This paper takes the native Notepad.exe as the research object. Native 64-bit, the Notepad.exe is a 64-bit application.

1 Open With Peviewer

PE files generally include four parts, DOS header, NT header, section table and specific sections. The first three parts are shown.

2 DOS Header

E_magic: A word type, the value is a constant 0x4d5a, with a text editor to view the value bit ' mz ', the executable must be ' MZ ' at the beginning.

E_lfanew: The domain that is extended for 32-bit executables, which represents the offset of the NT header after the DOS header relative to the file start address.

Look at the left-handed e_lfanew for 0x000000e8, find this address on the right, as shown on the 000000E0 line at the cursor;

The starting four bytes are 50 45 00 00, and the signature of the PE head on the right is in accordance with the corresponding;

3 File Header

Definition of PE file header:

typedef struct _IMAGE_FILE_HEADER {
WORD machine;
WORD numberofsections;
DWORD TimeDateStamp;
DWORD pointertosymboltable;
DWORD Numberofsymbols;
WORD Sizeofoptionalheader;
WORD characteristics;
} Image_file_header, *pimage_file_header;

Machine: The running platform of this file is x86, x64 or I64 and so on, which can be one of the lower denominations.
Numberofsections: How many sections in the PE file, that is, the number of items in the section table.
Timedatestamp:pe file creation time, usually has the connector fills in.

The contents of the left and right cursor are in accordance with the control.

4 Importing Tables

To calculate the starting address of the import table, it is difficult to calculate, use the tool to see, such as; Import table start address is

0x00000178

Peviewer the contents of the imported table;

Look at 16 in the binary file of 00000178, and peviewer given the seemingly inconsistent, but here is not quite understand;

16 binary files and the content given by Petool is consistent;

5 function names in the import table

Try to find the name of the imported SetWindowText function in the 16 binary file position;

What is thunk RVA, is not very familiar with the related calculation;

Directly find 0000d640 place to see, not setwindowtext;

Use the search function to find SetWindowText, in the following position; This RVA calculation is more complicated;

Link

Http://www.pediy.com/kssd/tutorial/chap8-1-6.htm
http://blog.csdn.net/evileagle/article/details/11693499

A preliminary study on the format of PE file by means of graphic tools