cve pe

[PE format Analysis] 4. IMAGE_FILE_HEADER, imagefileheader The source code is as follows: Typedef struct _ IMAGE_FILE_HEADER {+ 04 h WORD Machine; // running platform + 06 h WORD NumberOfSections; // number of file blocks + 08 h DWORD TimeDateStamp; // file creation date and time + 0Ch DWORD PointerToSymbolTable; // point to the symbol table (mainly used for debugging) + 10 h DWORD NumberOfSymbols; // Number of symbols in the symbol table (same as ab

[PE Structure Analysis] 5. IMAGE_OPTIONAL_HEADER, imageoptionalheader The source code of the struct is as follows: Typedef struct _ IMAGE_OPTIONAL_HEADER {// Standard fields. // + 18 h WORD Magic; // flag, ROM image (0107 h), common executable file (010Bh) + 1Ah BYTE MajorLinkerVersion; // The main version of the linked program + 1Bh BYTE MinorLinkerVersion; // The minor version of the linked program + 1Ch DWORD SizeOfCode; // the total size of all s

This IMAGE_NT_HEADERS is actually the image header of the PE-related structure. NT, I guess it should be the abbreviation of New Technology. It is different from the New DOS WIN9X Technology. It doesn't matter whether you think it is NTR or not.The structure of IMAGE_NT_HEADERS is like this.IMAGE_NT_HEADERS STRUCT{+ 0 h DWORD Signature+ 4 h IMAGE_FILE_HEADER FileHeader+ 18 h IMAGE_OPTIONAL_HEADER32 OptionalHeader} IMAGE_NT_HEADERS ENDSIt contains two

Resource segments in PE format are complex, at present, several books about the PE format are not deep enough to introduce this article (I think it is well written in the "Windows 95 system programming secrets" Hou Jie translation ), therefore, you have to pick up the tools for your own research and analyze the PE formats, such as stud_pe and ultraedit. Follow th

Method one, as shown below Into the system blue screen crash, reload system is also this phenomenon, into PE will also be computer blue screen, into the PE screen, we tend to be memory or video card problems, but replace the memory and graphics card, into the PE system or blue screen. If it is the problem of the motherboard often this kind of problem is more dif

PE format eighth, TLS table (thread-local storage)IbinarySource: http://www.cnblogs.com/iBinary/All rights reserved, welcome to keep the original link to reprint:)I. Review thread-related knowledgeThe first time to explain the TLS, you need to review thread-related knowledge (thread local storage)1. Understanding Classic Sync IssuesFirst we write a C + + code, open two threads to run to see if there will be synchronization problems.The result is that

PE System blue screen how to solve? Into the system blue screen crash, reload system is also this phenomenon, into PE will also be computer blue screen, into the PE screen, we tend to be memory or video card problems, but replace the memory and graphics card, into the PE system or blue screen. If it is the problem of

Release date:Updated on: Affected Systems:Heaventools Software PE Explorer 1.xDescription:--------------------------------------------------------------------------------Bugtraq id: 53618 PE Explorer is a visual Chinese integration tool that allows you to directly browse and modify software resources, including menus, dialogs, and string tables. In addition, it also supports decompilation of W32DASM softw

Introduction: The Installation of U disk Startup Disk production tools allows you to fully independent professional-grade maintenance system, more able to throw away the huge system for daily network office. Tools are simple and practical, easy to operate and fast, compatibility is super, support ISO production, write USB flash drive, CD burning, Custom PE toolbox, custom home page and other functions. And with write protection, anti-virus intrusion a

The location and size of the imported table can be obtained from the data directory Field of the image_optional_header32 structure in the PE file header. The corresponding project is the 2nd image_data_directory structure of the datadirectory field, obtain the RVA value of the import table from the virtualaddress field of the structure. An import table consists of a series of image_import_descriptor structures. The number of structures depends on the

Detailed tutorial on installing win7 and win8 systems for cabbage pe, win7win8 This is a detailed tutorial on installing win7 and win8 systems for cabbage pe. . Insert the prepared Chinese cabbage USB flash drive into the USB interface and restart the computer. When the boot screen is displayed, use the boot hotkey to guide the USB flash drive to the main menu interface of Chinese cabbage, select "[03] R

Reprint Source: http://www.upzxt.com/article/winpe/10333.htmlInstall the CentOS system in WinPE using a USB flash drive, simply record it and make some minor changes to the original.Personal experience: General U disk PE tools will generally choose the old peaches, this tool is very powerful, integrated with a variety of installed tools, using it whether Windows, Linux, MacOS can be installed, and very light, as long as hundreds of trillion, made of

Tools:Petool,minihex,peviewerThis paper takes the native Notepad.exe as the research object. Native 64-bit, the Notepad.exe is a 64-bit application.1 Open With PeviewerPE files generally include four parts, DOS header, NT header, section table and specific sections. The first three parts are shown.2 DOS HeaderE_magic: A word type, the value is a constant 0x4d5a, with a text editor to view the value bit ' mz ', the executable must be ' MZ ' at the beginning.E_lfanew: The domain that is extended f

Today, using win PE to modify the password of the XP system, there are three waysOne. Finally found a method, this method can only rewrite the password, that is, leave traces, as follows:1. Tools used: Fbinsttool v1.50Fbinsttool_ format _ Initialize U-disk. rar2, after the software download, after installation, to set up, such as:Now you have inserted the U-disk, and this step is to format and set the U-disk3, the second step is set:Such as:After the