合肥程序员群：49313181。    合肥实名程序员群 ：128131462 (不愿透露姓名和信息者勿加入)
Q  Q:408365330     E-Mail:egojit@qq.com

 1 typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
 2 +0   WORD   e_magic;                     // Magic number
 3 +2   WORD   e_cblp;                      // Bytes on last page of file
 4 +4   WORD   e_cp;                        // Pages in file
 5 +6   WORD   e_crlc;                      // Relocations
 6 +8   WORD   e_cparhdr;                   // Size of header in paragraphs
 7 +A   WORD   e_minalloc;                  // Minimum extra paragraphs needed
 8 +C   WORD   e_maxalloc;                  // Maximum extra paragraphs needed
 9 +E   WORD   e_ss;                        // Initial (relative) SS value
10 +10   WORD   e_sp;                        // Initial SP value
11 +12   WORD   e_csum;                      // Checksum
12 +14    WORD   e_ip;                        // Initial IP value
13 +16    WORD   e_cs;                        // Initial (relative) CS value
14 +18    WORD   e_lfarlc;                    // File address of relocation table
15 +1A    WORD   e_ovno;                      // Overlay number
16 +1C    WORD   e_res[4];                    // Reserved words
17 +24    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
18 +26    WORD   e_oeminfo;                   // OEM information; e_oemid specific
19 +28    WORD   e_res2[10];                  // Reserved words
20 +3C    LONG   e_lfanew;                    // File address of new exe header
21   } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

1 typedef struct _IMAGE_NT_HEADERS {
2 +00h    DWORD Signature;
3 +04h    IMAGE_FILE_HEADER FileHeader;
4  ???    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
5 } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

版权：归博客园和Egojit所有，转载请标明出处。