Author: little heartPrevious: http://www.bkjia.com/Article/201202/118214.htmlThere are many structures in the PE file, but in fact, more than half of these structures tell the loader how to load its PE. Normal PE files are always strictly filled with their internal structures, but there are also a small number of deformation
V. Section Table)
The section table is a structure array next to the PE Header. The number of members of this array is determined by the value of the numberofsections field in the file header (image_file_header) structure. The member structure of the table is also named image_section_header (40 bytes ). Its structure definition:
Typedef struct _ image_section_header {Byte name [image_sizeof_short_name];Union {DWORD physicaladdress;DWORD virtualsize;}
V. Section Table)The section table is a structure array next to the PE Header. The number of members of this array is determined by the value of the numberofsections field in the file header (image_file_header) structure. The member structure of the table is also named image_section_header (40 bytes ). Its structure definition:Typedef struct _ image_section_header {Byte name [image_sizeof_short_name];Union {DWORD physicaladdress;DWORD virtualsize;} MI
PE means portable executable (portable execution body ). It is the execution body file format of the Win32 environment. Some of its features inherit from the Unix coff (Common Object File Format) file format. "Portable executable" means that the file format is cross-Win32: Even if windows runs on a non-Intel CPU, the PE Loader on any Win32 platform can recognize and use this file format. Of course, there mu
How to find enhancements in SAPMethod one, using Tcode to find reinforcement (second generation enhancement)Execute a program (attached to the source code), enter the program you need to enhance the tcode at the selection screen, and after execution, a list will appear, where there is a great majority of smod enhancements on how to enhance this.Click inside to manually find the enhancements you need.This is the second generation of enhancedMethod two,
At present, PE routers are widely used. They are one type of VPN routers. So I have studied the explanations and principles of PE routers and will share them with you here, I hope it will be useful to you. VPNVirtual Private Network (VPNVirtual Private Network) is a virtual Private Network based on public networks. It uses tunneling, encryption, and other technologies to provide users with a sense of direct
Text/tU niuyuan
We all know that in Windows 9x, NT, and 2000, all Executable files are based on a new Microsoft-designed File Format (Portable Executable File Format), that is, the PE Format. In some cases, we need to modify these executable files. The following text attempts to describe the PE file format and modify the PE format file in detail.
Document directory
1.3.1 hosting PE files
Text/Xuan Hun
Intermediate Language
In the. NET Framework, the basic structure of public languages uses Cls to bind different languages. By requiring different languages to at least implement the CTS contained in CLs, the public language infrastructure allows different languages to use the. NET Framework. Therefore. in the. NET Framework, all languages (C #, VB. net, effil. net) is finally converted to a
a separate thread. After the virus obtains control, it creates the corresponding search and infection thread, and gives the master ready-to-use control to the original program.
Modify and infect PE files
Now that you have been able to search for all files in disk and network shared files and want to implement parasitic operations, the next step is to infect the searched PE files. An important consideration
Question: an absolutely detailed tutorial on manually Constructing PE files.
Reprint Please Note Copyright: A1Pass http://a1pass.blog.163.com/
I have been learning the PE file structure for a long time and never dared to look down on it. But even so, I still find myself lacking in this aspect, so I thought of creating a complete executable PE file by hand. Durin
All-finger medicine (SH000991)-2018-10-18, current value: 22.8575, average: 36.88, median: 36.27655, currently close to the lowest level of history. All-finger medicine (SH000991) history P/E ratio PE detailsEnvironmental protection (SH000827)-2018-10-18, current value: 16.0137, average: 28.73, median: 27.53245, currently close to the lowest level of history. Certificate of Environmental Protection (SH000827) of the history of
Generic PE Toolbox 1.9.6 (XP kernel) by Uepon (Li Peicong)Official website: http://hi.baidu.com/uepon?page=2Version 1.8 forum Posts: http://bbs.wuyou.net/forum.php?mod=viewthreadtid=119749General PE1.9.6 Introduction: HTTP://HI.BAIDU.COM/UEPON/ITEM/CEAFEB322BA148B9633AFFD3General PE V1.9.6 (XP kernel) Original: http://pan.baidu.com/s/1o6Fotx4Tonpe_xp_v1.9.6.exe does not include network card driver 39.8mb,to
For low-layer windows programming, API Interception is always an exciting thing. Is it more interesting to use your own code to change the behavior of other programs? In addition, in the process of implementing API Interception, we also have the opportunity to familiarize ourselves with many things that are rarely touched by in the RAD programming environment, such as DLL Remote injection, memory management, and PE file format. Many commercial softwar
PE file structure (1)
Reference
Book: encryption and decryption
Video: Little Turtle decryption series video
EXE and DLL are all PE (portable execute) file structures. PE files use a flat address space. All code and data are merged to form a large structure. Let's take a look at two pictures to get a rough idea of the PE
Http://www.vckbase.com/document/viewdoc? Id = 1335
Detailed description of PE File Format (II)
Author: msdnAuthor: Li Ma (http://home.nuc.edu.cn /~ Titilima)
Pre-defined section
A Windows NT ApplicationProgramTypically, nine predefined segments are available:. Text,. BSS,. RDATA,. Data,. rsrc,. edata,. idata,. pdata, And. debug. Some applications do not need all these segments, and some applications define more segments for their special ne
I. PE Structure Basics
I have read a lot of PE Structure stuff, or the overall structure, or a lot of ASM code. I am a little uncomfortable looking at cainiao! So write a post on your own and learn PE. Let's first understand a few questions!1: Concepts of several addressesVA: virtual address, that is, the address in the memory!RVA: relative virtual address, equal
Preface:
The initial shell was developed in infectious virus technology, with the goal of compressing or encrypting the shell. This article mainlyThis section briefly introduces and summarizes the implementation of Win32 PE and Linux elf shelling programs on the X86 platform.The program provides clues, in which the program source code is open-source. If you are interested, you can continue to improve the program.
PS: some of them haven't been touched
Author: msdnAuthor: Li Ma (http://home.nuc.edu.cn /~ Titilima)
Pre-defined section
A Windows NT application typically has nine predefined segments, which are. text ,. BSS ,. RDATA ,. data ,. rsrc ,. edata ,. idata ,. pdata and. debug. Some applications do not need all these segments, and some applications define more segments for their special needs. This approach is similar to code segments and data segments in MS-DOS and Windows 3.1. In fact, the method by which an application defines a uniqu
method of repairing system faults with PE
PE is commonly used in the first aid system, installed in this machine can be very convenient in the event of Windows failure to carry out effective maintenance operations. However, many people do not install PE when the system is normal, until the system has a serious failure can not enter the thought of it. Is there an
PE is commonly used in the first aid system, it is installed in the machine can be easily in the event of Windows failure to carry out effective maintenance operations. However, many people do not install PE when the system is normal, wait until the system has a serious failure to enter when the thought of it. Is there a way to mend it? Here we introduce the steps.
First, the
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.