信息对抗技术知识-病毒 研究生课程 .pptVIP

dos header 64字节 Not running in dos… Signature FileHeader Option header Section1 header Section2 header section1 section2 固定头部 Dos 头部 NT头部 节表 节区 代码段 数据段 Dos 头部 见后页，该部分兼容以前dos的程序 TImage_Dos_Header = record e_magic: Word; // Magic number e_cblp: Word; // Bytes on last page of file e_cp: Word; // Pages in file e_crlc: Word; // Relocations e_cparhdr: Word; // Size of header in paragraphs e_minalloc: Word; // Minimum extra paragraphs needed e_maxalloc: Word; // Maximum extra paragraphs needed e_ss: Word; // Initial (relative) SS value e_sp: Word; // Initial SP value e_csum: Word; // Checksum e_ip: Word; // Initial IP value e_cs: Word; // Initial (relative) CS value e_lfarlc: Word; // File address of relocation table e_ovno: Word; // Overlay number e_res: array[0..4-1] of Word; // Reserved words e_oemid: Word; // OEM identifier (for e_oeminfo) e_oeminfo: Word; // OEM information; e_oemid specific e_res2: array[0..10 - 1] of Word; // Reserved words e_lfanew: Cardinal; // File address of new exe header end; 该头部的第一个字段e_magic就是MZ。 最后一个字段e_lfanew是偏移量，就是从文件头部到NT头部的偏移量，包括了dos头部。 NT头部处于dos头部的后面。 NT头部 TImage_NT_Headers32 = record Signature: Cardinal; FileHeader: TImage_File_Header; OptionalHeader: TImage_Optional_Header32; end; Signature字段头两个字节是’PE’,表明是pe格式的文件。我们判断一个文件是否是pe格式，只要先判断文件头2字节是否是’MZ’，然后判断nt头部的signature是否是’PE’. TImage_File_Header = record Machine: Word; NumberOfSections: Word; TimeDateStamp: Cardinal; PointerToSymbolTable: Cardinal; NumberOfSymbols: Cardinal; SizeOfOptionalH