小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
来源:互联网 发布:linux deploy镜像站 编辑:程序博客网 时间:2024/06/11 17:07
typedef struct _IMAGE_FILE_HEADER
{
+04hWORD Machine; // 运行平台
+06h WORD NumberOfSections;// 文件的区块数目
+08hDWORD TimeDateStamp;// 文件创建日期和时间
+0Ch DWORD PointerToSymbolTable;// 指向符号表(主要用于调试)
+10h DWORD NumberOfSymbols;// 符号表中符号个数(同上)
+14h WORD SizeOfOptionalHeader;// IMAGE_OPTIONAL_HEADER32 结构大小
+16h WORD Characteristics;// 文件属性
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
该结构如下图所示:
- IMAGE_FILE_MACHINE_I386
- 0x014c
x86
- IMAGE_FILE_MACHINE_IA64
- 0x0200
Intel Itanium
- IMAGE_FILE_MACHINE_AMD64
- 0x8664
x64
The characteristics of the image. This member can be one or more of the following values.
- IMAGE_FILE_RELOCS_STRIPPED
- 0x0001
Relocation information was stripped from the
file. The file must be loaded at its preferred
base address. If the base address is not
available, the loader reports an error.
- IMAGE_FILE_EXECUTABLE_IMAGE
- 0x0002
The file is executable (there are no unresolved
external references).
- IMAGE_FILE_LINE_NUMS_STRIPPED
- 0x0004
COFF line numbers were stripped from the
file.
- IMAGE_FILE_LOCAL_SYMS_STRIPPED
- 0x0008
COFF symbol table entries were stripped from
file.
- IMAGE_FILE_AGGRESIVE_WS_TRIM
- 0x0010
Aggressively trim the working set. This value is
obsolete as of Windows 2000.
- IMAGE_FILE_LARGE_ADDRESS_AWARE
- 0x0020
The application can handle addresses larger
than 2 GB.
- IMAGE_FILE_BYTES_REVERSED_LO
- 0x0080
The bytes of the word are reversed. This flag
is obsolete.
- IMAGE_FILE_32BIT_MACHINE
- 0x0100
The computer supports 32-bit words.
- IMAGE_FILE_DEBUG_STRIPPED
- 0x0200
Debugging information was removed and stored
separately in another file.
- IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
- 0x0400
If the image is on removable media, copy it to
and run it from the swap file.
- IMAGE_FILE_NET_RUN_FROM_SWAP
- 0x0800
If the image is on the network, copy it to and
run it from the swap file.
- IMAGE_FILE_SYSTEM
- 0x1000
The image is a system file.
- IMAGE_FILE_DLL
- 0x2000
The image is a DLL file. While it is an executable
file, it cannot be run directly.
- IMAGE_FILE_UP_SYSTEM_ONLY
- 0x4000
The file should be run only on a uniprocessor
computer.
- IMAGE_FILE_BYTES_REVERSED_HI
- 0x8000
The bytes of the word are reversed. This flag
is obsolete.
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 转载——小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用
- PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- 【51Nod】1051 - 最大子矩阵的和(dp)
- CSS Modules 详解及 React 中实践
- sizeof和strlen区别详解
- Setting Up File Sharing
- UVa 1586 Molar Mass(分子量)
- 小甲鱼PE详解之IMAGE_NT_HEADERS结构定义即各个属性的作用(PE详解02)
- n个字符串按照字典序排列
- 句柄与指针的区别与联系
- 小火山的宝藏收益
- 使用Heritrix进行主题抓取
- 正确的mysql5.6.24中my.ini配置文件
- 【NOIP2013】火柴排队
- 华为OJ——删除字符串中出现次数最少的字符
- 自定义View——Path的基本用法