PE文件格式分析源码(C)

File: ShellCode.exe Isgnature:MZ LengthOfImage:144 SizeOfFile:3 NumberOfRelocationItems:0 SizeOfHeader:4 MinPara:0 MaxPara:65535 OffsetStack:0 InitialSp:184 NegativeChecksum:0 InitialIp:0 OffsetCs:0 OffsetFirstRelocationItem:64 OverlayNumber:0 Res1:0 Res2:0 Res3:0 Res4:0 OemId:0 OemInfo:0 Res5[0]:0 Res5[1]:0 Res5[2]:0 Res5[3]:0 Res5[4]:0 OffsetToPEHeader:128 dosstub:º Sig:PE CpuType:332 NumSections:7 Tm:1226675918 PointerToSymbolTable:10240 NumberOfSymbols:466 NtHeaderSize:224 Flags:263 Res3:267 LMajor: LMajor:2 LMinor:8 LMinor:56 SizeOfCode:3072 SizeOfInitData:5120 SizeOfUninitData:512 EntrypointRva:4736 BaseOfCode:4096 BaseOfData:8192 ImageBase:4194304 SectionAlign:4096 FileAlign:512 OsMajor:4 OsMinor:0 UserMajor:1 UserMinor:0 SubsystemMajor:4 SubsystemMinor:0 Win32VersionValue:0 ImageSize:32768 HeaderSize:1024 FileChecksum:72286 Subsystem:3 DllFlags:0 StackReserveSize:2097152 StackCommitSize:4096 HeapReserveSize:1048576 HeapCommitSize:4096 LoaderFlags:0 NumInterestingRvaSize:16 rva:0 size:0 rva:20480 size:636 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 rva:0 size:0 Name:.text VirtualSize:2632 VirtualAddress:4096 SizeOfRawData:3072 PointerToRawData:1024 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:1613758560 Name:.data VirtualSize:100 VirtualAddress:8192 SizeOfRawData:512 PointerToRawData:4096 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:-1070596032 Name:.rdata VirtualSize:296 VirtualAddress:12288 SizeOfRawData:512 PointerToRawData:4608 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:1076887616 Name:.bss VirtualSize:224 VirtualAddress:16384 SizeOfRawData:0 PointerToRawData:0 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:-1070595968 Name:.idata VirtualSize:636 VirtualAddress:20480 SizeOfRawData:1024 PointerToRawData:5120 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:-1070596032 Name:.stab VirtualSize:1272 VirtualAddress:24576 SizeOfRawData:1536 PointerToRawData:6144 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:36702208 Name:.stabstr VirtualSize:2370 VirtualAddress:28672 SizeOfRawData:2560 PointerToRawData:7680 PointerToRelocations:0 PointerToLinenumbers:0 NumberOfRelocations:0 NumberOfLinenumbers:0 Characteristics:34605056 block.name:.text block.size:3072 block.data:U‰åƒì‰]ø‹E1ۉuü‹ block.name:.data block.size:512 block.data: block.name:.rdata block.size:512 block.data:A=%p block.name:.bss block.size:0 block.name:.idata block.size:1024 block.data:@P block.name:.stab block.size:1536 block.data:
block.name:.stabstrB block.size:2560 block.data: