《역방향 공정 핵심 원리》 학습노트 4 PE 파일 학습-PE 헤드 총결산

《역방향 공정의 핵심 원리》 학습 노트4
PE 파일 학습 - PE 헤드 요약
1. DOS 헤드

typedef struct _IMAGE_DOS_HEADER   //DOS 
{
WORD e_magic;       //DOS signature :4D5A ("MZ"，     ，
                      DOS  ,      ，      ）
WORD e_cblp;
WORD e_cp;
WORD e_crlc;
WORD e_cparhdr;
WORD e_minalloc;
WORD e_maxalloc;
WORD e_ss;
WORD e_sp;
WORD e_csum;
WORD e_ip;
WORD e_cs;NT
WORD e_lfarlc;
WORD e_ovno;
WORD e_res[4];
WORD e_oemid;
WORD e_oeminfo;
WORD e_res2[10];
WORD e_lfanew;  //NT    ，offset to NT header,     
                      
} IMAGE_DOS_HEADER,  *PIMAGE_DOS_HEADER;

2. DOS 메모리는 코드와 데이터가 혼합되어 DOS 환경에서 실행되며 debug를 사용할 수 있다.exe 실행(window10에서 DOSBOX+debug)
3. NT 헤드

typedef struct _IMAGE_NT_HEADERS       //NT 
{
DWORD Signature;                       //     ，  50450000h, "PE00"
IMAGE_FILE_HEADER FileHeader;          //   
IMAGE_OPTIONAL_HEADER32 OptionalHeader;//   
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

typedef struct _IMAGE_FILE_HEADER     //   
{
WORD Machine;              //CPU   ，   CPU    Machine 
WORD NumberOfSections;     //            
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader; //  IMAGE_OPTIONAL_HEADER32   
WORD Characteristics;
}IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

typedef struct _IMAGE_DATA_DIRECTORY
{
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16

typedef struct _IMAGE_OPTIONAL_HEADER
{
WORD Magic;     //  IMAGE_OPTIONAL_HEADER32 ，Magic  10B， IMAGE_OPTIONAL_HEADER64 ，Magic   20B
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;   //EP RVA ，             
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;             //           ，ImageBase                 
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD  SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

//     DataDirectory
DataDirectory[0] = EXPORT Directory;
DataDirectory[1] = IMPORT Directory;
DataDirectory[2] = RESOURCE Directory;
DataDirectory[3] = EXCEPTION Directory;
DataDirectory[4] = SECURITY Directory;
DataDirectory[5] = BASERELOC Directory;
DataDirectory[6] = DEBUG Directory;
DataDirectory[7] = COPYRIGHT Directory;
DataDirectory[8] = GLOBALPTR Directory;
DataDirectory[9] = TLS Directory;
DataDirectory[A] = LOAD_CONFIG Directory;
DataDirectory[B] = BBOUND_IMPORT Directory;
DataDirectory[C] = IAT Directory;
DataDirectory[D] = DELAY_IMPORT Directory;
DataDirectory[E] = COM_DESCRIPTOR Directory;
DataDirectory[F] = Reserved Directory;

4. 헤더는 헤더에서 데이터,resource,code 세 개의 헤더에 대해 특성과 접근 권한을 설정하는 작업을 한다.세 개의 노드 헤드가 각각 대응하는 노드를 제어한다.

#define IMAGE_SIZEOF_SHORT_NAME      8
typedef struct _IMAGE_SECTION_HEADER
{
BYTE   NAME[IMAGE_SIZEOF_SHORT_NAME];
union
{
DWORD PhysicalAddress;
DWORD VirtualSize;         //        
} Misc;
DWORD   VirtualAddress;    //          
DWORD   SizeOfRawData;     //          
DWORD   PointerToRawData;  //            
DWORD   PointerToRelocations;
DWORD   PointerToLinenumbers;
WORD    NumberOfRelocations;
WORD    NumberOfLinenumbers;
DWORD   Characteristics;   //     ，     code，     ，     ，    ，        
}IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

이상은 내가 정리한 공부해야 할 중점이니, 부족하면 큰 사람이 지적해 주시기 바랍니다.