pe你如何做系统文件-(怎么用pe做系统)

pe如何制作系统文件？ (怎么用pe做系统)

工具

1.010Editor ：填充16进制码

2.lordPE ：检查PE文件错误的原因

知识背景

1. PE知识：（PE中结构体的字段分布，PE加载器原理)

2. 汇编知识：（汇编调用MessageBoxA个ExitProcess）

目标：构建程序（CUI）.exe

程序功能：

1. 调用MessageBoxA弹出消息框

2. 调用ExitProcess退出程序

思路

1.在Windows下PE如何操作文件格式的程序？

答：符合PE格式的文件系统加载器，如何成功操作程序，失败，报错。

2.系统加载的原理或执行逻辑是什么？

答：

加载器：简单执行流程如下：

1.内存映射

2.修复IAT

3.修复重定位

tip：这个程序没有重定位，只需要考虑前两步。

3.PE如何构建文件？还能做哪些优化？

答：

构建：

1.Dos头：IMAGE_DOS_HEADER;

1.1->WORD e_magic; //标识符：MZ

1.2->LONG e_lfanew; //Dos头部的大小

2.NT头：IMAGE_NT_HEADERS32

2.1->DWORD Signature;

2.2->IMAGE_FILE_HEADER FileHeader;

2.3->IMAGE_OPTIONAL_HEADER32 OptionalHeader;

3.区段头：IMAGE_SECTION_HEADER

3.1 ->.text

3.2 ->.rdata

4.区段数据：数据

4.1 ->代码数据(OpCode) == 200

4.2 ->导入数据(IAT、导入表、INT、HitName) == 200

优化：

1.DosStub是历史遗留问题，在某些情况下，该区域也可以填写代码，但该区域可以在此程序中删除。

2.区段减少到2个，.text、.rdata。

2.区段减少到2个，.text、.rdata。（ps:其实也可以减少到只有一个区段.text）

3.用0填充对程序运行无影响的字段。

构造PE步骤

1.整理以上思路，大致可以得到以下思维导图

仔细观察PE不难发现，文件的格式到处都反映在头部身体，目录内容管理数据的理念是手工建立的PE文件也可以作为构建文件的思路PE文件。(最好在最好同时做这两件事，有助于加快进度)

1.组成头部：

1.1-Dos头

typedef struct _IMAGE_DOS_HEADER{ // DOS .EXE header WORD e_magic; // Magic number WORD e_cblp; // Bytes on last page of file WORD e_cp; // Pages in file WORD e_crlc; // Relocations WORD e_cparhdr; // Size of header in paragraphs WORD e_minalloc; // Minimum extra paragraphs needed WORD e_maxalloc; // Maximum extra paragraphs needed WORD e_ss; // Initial (relative) SS value WORD e_sp; // Initial SP value WORD e_csum; // Checksum WORD e_ip; // Initial IP value WORD e_cs; // Initial (relative) CS value WORD e_lfarlc; // File address of relocation table WORD e_ovno; // Overlay number WORD e_res[4]; // Reserved words WORD e_oemid; // OEM identifier (for e_oeminfo) WORD e_oeminfo; // OEM information; e_oemid specific WORD e_res2[10]; // Reserved words LONG e_lfanew; // File address of new exe header }IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

关键字段：

1. WORD e_magic; ==> MZ => 4D 5A (标识符)

2. LONG e_lfanew; ==> 40h => 40 00 00 00(DosStub去除后，IMAGE_DOS_HEADER 结构尺寸为Dos头大小)

4D 5A

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00

00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

40 00 00 00

1.2-NT头

typedef struct _IMAGE_NT_HEADERS{

DWORD Signature;

IMAGE_FILE_HEADER FileHeader;

IMAGE_OPTIONAL_HEADER32 OptionalHeader;

}IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

关键字段：

1.2.1.DWORD Signature; ==> PE ==>50 45 00 00 (标识符)

1.2.2IMAGE_FILE_HEADER FileHeader;

typedef struct _IMAGE_FILE_HEADER{

WORD Machine;

WORD NumberOfSections;

DWORD TimeDateStamp;

DWORD PointerToSymbolTable;

DWORD NumberOfSymbols;

WORD SizeOfOptionalHeader;

WORD Characteristics;

}IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

关键字段

2.1 WORD Machine; ==> x86 ==> 4c 01 (0x014c 应用的机器型号)

2.2 WORD NumberOfSections; ==> 2个 ==> 02 00 (1.text 2.rdata)

2.3 WORD SizeOfOptionalHeader; ==> E0 ==> E0 00 (NT扩展头大小)

2.4 WORD Characteristics; ==> 10F ==> 0F 01 (可自定义)

1.2.3. IMAGE_OPTIONAL_HEADER32 OptionalHeader;

typedef struct _IMAGE_OPTIONAL_HEADER{

// // Standard fields. // WORD Magic;

BYTE MajorLinkerVersion;

BYTE MinorLinkerVersion;

DWORD SizeOfCode;

DWORD SizeOfInitializedData;

DWORD SizeOfUninitializedData;

DWORD AddressOfEntryPoint;

DWORD BaseOfCode;

DWORD BaseOfData;

// // NT additional fields. // DWORD ImageBase;

DWORD SectionAlignment;

DWORD FileAlignment;

WORD MajorOperatingSystemVersion;

WORD MinorOperatingSystemVersion;

WORD MajorImageVersion;

WORD MinorImageVersion;

WORD MajorSubsystemVersion;

WORD MinorSubsystemVersion;

DWORD Win32VersionValue;

DWORD SizeOfImage;

DWORD SizeOfHeaders;

DWORD CheckSum;

WORD Subsystem;

WORD DllCharacteristics;

DWORD SizeOfStackReserve;

DWORD SizeOfStackCommit;

DWORD SizeOfHeapReserve;

DWORD SizeOfHeapCommit;

DWORD LoaderFlags;

DWORD NumberOfRvaAndSizes;

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];

}IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

*PIMAGE_OPTIONAL_HEADER32;

关键字段

3.1 WORD Magic; ==> 10B ==>0B 01 (文件类型:PE32文件)

3.2 DWORD AddressOfEntryPoint; ==> 1000 ==>00 10 00 00(.text在文件中200h位置，内存偏移1000h)

3.2 DWORD ImageBase; ==> 40000 ==>00 00 04 00 (PE优先加载内存文件的起始地址VA)

3.3 DWORD SectionAlignment; ==> 1000h ==>00 10 00 00 (内存对齐)

3.4 DWORD FileAlignment; ==> 200h ==>00 02 00 00 (文件对齐)

3.5 WORD Ma jo

世界杯彩票怎么买