File Header Mage_file_header

Image_file_header This structure is defined as follows: TypeDefstruct_image_file_header {00h WORD machine; //Operating Platform02h WORD numberofsections;//Number of blocks06h DWORD TimeDateStamp;//file date time stamp0Ah DWORD pointertosymboltable;//point to Symbol table0Eh DWORD Numberofsymbols;//number of symbols in the symbol table12h WORD Sizeofoptionalheader;//the size of the image's optional header structure 22414h WORD characteristics;//file characteristic values} image_file_header, *Pimage_file_header; This structure indicates the basic characteristic attribute of a PE file, and also the entrance of a PE file. The machine domain shows what CPU the PE file is running on, as follows:#defineImage_file_machine_unknown 0#defineImage_file_machine_i386 0x014c//Intel 386.    #defineimage_file_machine_r3000 0x0162//MIPS Little-endian, 0x160 Big-endian    #defineimage_file_machine_r4000 0x0166//MIPS Little-endian    #defineimage_file_machine_r10000 0x0168//MIPS Little-endian    #defineImage_file_machine_wcemipsv2 0x0169//MIPS Little-endian WCE v2    #defineImage_file_machine_alpha 0x0184//Alpha_axp    #defineImage_file_machine_powerpc 0x01f0//IBM PowerPC Little-endian    #defineImage_file_machine_sh3 0X01A2//SH3 Little-endian    #defineimage_file_machine_sh3e 0x01a4//sh3e Little-endian    #defineImage_file_machine_sh4 0x01a6//SH4 Little-endian    #defineImage_file_machine_arm 0x01c0//ARM Little-endian    #defineImage_file_machine_thumb 0X01C2#defineImage_file_machine_ia64 0x0200//Intel    #defineIMAGE_FILE_MACHINE_MIPS16 0x0266//MIPS    #defineIMAGE_FILE_MACHINE_MIPSFPU 0x0366//MIPS    #defineImage_file_machine_mipsfpu16 0x0466//MIPS    #defineImage_file_machine_alpha64 0x0284//ALPHA64    #defineImage_file_machine_axp64 Image_file_machine_alpha64numberofsections The number of chunks in the PE file. TimeDateStamp file date timestamp refers to the time that the PE file was generated, and its value is from December 31, 1969:xx: The number of seconds since 00.   Pointertosymboltable COFF The offset address of the debug symbol table. Numberofsymbols the number of symbols in the COFF symbol table.   This domain and the previous domain in the release version of the program is 0. Sizeofoptionalheader the size of the IMAGE_OPTIONAL_HEADER32 structure (that is, how many bytes). We will then refer to this structure. In fact, most of the important fields of the PE file are in the Image_optional_   In the header structure. Characteristics This field describes some of the properties of a PE file, such as whether it is executable, whether it is a dynamic connection library, and so on. The definition is as follows:#defineimage_file_relocs_stripped 0x0001//Relocation information is removed#defineImage_file_executable_image 0x0002//File Executable#defineimage_file_line_nums_stripped 0x0004//line number is removed#defineimage_file_local_syms_stripped 0x0008//The symbol has been removed#defineImage_file_aggresive_ws_trim 0x0010//agressively Trim Working Set#defineImage_file_large_address_aware 0x0020//The program can handle addresses larger than 2G#defineImage_file_bytes_reversed_lo 0x0080//Bytes of machine Word is reversed.#defineImage_file_32bit_machine 0x0100//32-bit machine#defineimage_file_debug_stripped 0x0200//debugging information for. dbg files is removed#defineImage_file_removable_run_from_swap 0x0400//If you are running on a removable media, copy to swap file#defineImage_file_net_run_from_swap 0x0800//If you are running in a network, copy to a swap file#defineImage_file_system 0x1000//System Files#defineImage_file_dll 0x2000//file is a DLL#defineImage_file_up_system_only 0x4000//files can only be run on a single processor#defineImage_file_bytes_reversed_hi 0x8000//Bytes of machine Word is reversed.

File Header Mage_file_header