MicrosoftPortableExecutableandCommonObjectFileFormatSpecification-1999(pecoff)-计算机科学资源-CSDN文库

109 浏览量 2021-04-22 18:29:14 上传评论收藏 764KB PDF 举报

资源推荐

资源详情

资源评论

Microsoft Portable Executable and

Common Object File Format Specification

Microsoft Corporation

Revision 6.0 - February 1999

1. General Concepts

This document specifies the structure of executable (image) files and object files under the

Microsoft Windows NT® operating system. These files are referred to as Portable Executable

(PE) and Common Object File Format (COFF) files respectively. The name “Portable Executable”

refers to the fact that the format is not architecture-specific.

Certain concepts appear repeatedly throughout the specification and are described in the

following table:

Name

Description

Image file

Executable file: either a .EXE file or a DLL. An image file can be

thought of as a “memory image.” The term “image file” is usually

used instead of “executable file,” because the latter sometimes is

taken to mean only a .EXE file.

Object file

A file given as input to the linker. The linker produces an image file,

which in turn is used as input by the loader. The term “object file”

does not necessarily imply any connection to object-oriented

programming.

RVA

Relative Virtual Address. In an image file, an RVA is always the

address of an item once loaded into memory, with the base address

of the image file subtracted from it. The RVA of an item will almost

always differ from its position within the file on disk (File Pointer).

In an object file, an RVA is less meaningful because memory

locations are not assigned. In this case, an RVA would be an

address within a section (see below), to which a relocation is later

applied during linking. For simplicity, compilers should just set the

first RVA in each section to zero.

Virtual Address (VA)

Same as RVA (see above), except that the base address of the

image file is not subtracted. The address is called a “Virtual

Address” because Windows NT creates a distinct virtual address

space for each process, independent of physical memory. For

almost all purposes, a virtual address should be considered just an

address. A virtual address is not as predictable as an RVA,

because the loader might not load the image at its preferred

location.

File pointer

Location of an item within the file itself, before being processed by

the linker (in the case of object files) or the loader (in the case of

image files). In other words, this is a position within the file as

stored on disk.

Date/Time Stamp

Date/time stamps are used in a number of places in a PE/COFF

file, and for different purposes. The format of each such stamp,

however, is always the same: that used by the time functions in the

C run-time library.

剩余72页未读，继续阅读

内容反馈

weixin_38718413

粉丝: 9
资源: 945

最新资源

资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！点击此处反馈

feedback-tip