windows逆向基础-PE文件结构详解（上）

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header   WORD   e_magic;                     // Magic number   WORD   e_cblp;                      // Bytes on last page of file   WORD   e_cp;                        // Pages in file   WORD   e_crlc;                      // Relocations   WORD   e_cparhdr;                   // Size of header in paragraphs   WORD   e_minalloc;                  // Minimum extra paragraphs needed   WORD   e_maxalloc;                  // Maximum extra paragraphs needed   WORD   e_ss;                        // Initial (relative) SS value   WORD   e_sp;                        // Initial SP value   WORD   e_csum;                      // Checksum   WORD   e_ip;                        // Initial IP value   WORD   e_cs;                        // Initial (relative) CS value   WORD   e_lfarlc;                    // File address of relocation table   WORD   e_ovno;                      // Overlay number   WORD   e_res[4];                    // Reserved words   WORD   e_oemid;                     // OEM identifier (for e_oeminfo)   WORD   e_oeminfo;                   // OEM information; e_oemid specific   WORD   e_res2[10];                  // Reserved words   LONG   e_lfanew;                    // File address of new exe header} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

typedef struct _IMAGE_NT_HEADERS {   DWORD Signature;                         //PE签名   IMAGE_FILE_HEADER FileHeader;            //文件头   IMAGE_OPTIONAL_HEADER32 OptionalHeader;  // 可选头} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

#define IMAGE_SIZEOF_FILE_HEADER             20#define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.#define IMAGE_FILE_EXECUTABLE_IMAGE         0x0002  // File is executable (i.e. no unresolved external references).#define IMAGE_FILE_LINE_NUMS_STRIPPED       0x0004  // Line nunbers stripped from file.#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.#define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Aggressively trim working set#define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.#define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.#define IMAGE_FILE_DEBUG_STRIPPED           0x0200  // Debugging info stripped from file in .DBG file#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.#define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.#define IMAGE_FILE_SYSTEM                   0x1000  // System File.#define IMAGE_FILE_DLL                       0x2000  // File is a DLL.#define IMAGE_FILE_UP_SYSTEM_ONLY           0x4000  // File should only be run on a UP machine#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
#define IMAGE_FILE_MACHINE_UNKNOWN           0#define IMAGE_FILE_MACHINE_TARGET_HOST       0x0001  // Useful for indicating we want to interact with the host and not a WoW guest.#define IMAGE_FILE_MACHINE_I386             0x014c  // Intel 386.#define IMAGE_FILE_MACHINE_R3000             0x0162  // MIPS little-endian, 0x160 big-endian#define IMAGE_FILE_MACHINE_R4000             0x0166  // MIPS little-endian#define IMAGE_FILE_MACHINE_R10000           0x0168  // MIPS little-endian#define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169  // MIPS little-endian WCE v2#define IMAGE_FILE_MACHINE_ALPHA             0x0184  // Alpha_AXP#define IMAGE_FILE_MACHINE_SH3               0x01a2  // SH3 little-endian#define IMAGE_FILE_MACHINE_SH3DSP           0x01a3#define IMAGE_FILE_MACHINE_SH3E             0x01a4  // SH3E little-endian#define IMAGE_FILE_MACHINE_SH4               0x01a6  // SH4 little-endian#define IMAGE_FILE_MACHINE_SH5               0x01a8  // SH5#define IMAGE_FILE_MACHINE_ARM               0x01c0  // ARM Little-Endian#define IMAGE_FILE_MACHINE_THUMB             0x01c2  // ARM Thumb/Thumb-2 Little-Endian#define IMAGE_FILE_MACHINE_ARMNT             0x01c4  // ARM Thumb-2 Little-Endian#define IMAGE_FILE_MACHINE_AM33             0x01d3#define IMAGE_FILE_MACHINE_POWERPC           0x01F0  // IBM PowerPC Little-Endian#define IMAGE_FILE_MACHINE_POWERPCFP         0x01f1#define IMAGE_FILE_MACHINE_IA64             0x0200  // Intel 64#define IMAGE_FILE_MACHINE_MIPS16           0x0266  // MIPS#define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64#define IMAGE_FILE_MACHINE_MIPSFPU           0x0366  // MIPS#define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466  // MIPS#define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64#define IMAGE_FILE_MACHINE_TRICORE           0x0520  // Infineon#define IMAGE_FILE_MACHINE_CEF               0x0CEF#define IMAGE_FILE_MACHINE_EBC               0x0EBC  // EFI Byte Code#define IMAGE_FILE_MACHINE_AMD64             0x8664  // AMD64 (K8)#define IMAGE_FILE_MACHINE_M32R             0x9041  // M32R little-endian#define IMAGE_FILE_MACHINE_ARM64             0xAA64  // ARM64 Little-Endian#define IMAGE_FILE_MACHINE_CEE               0xC0EE

#define IMAGE_SIZEOF_FILE_HEADER             20#define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.#define IMAGE_FILE_EXECUTABLE_IMAGE         0x0002  // File is executable (i.e. no unresolved external references).#define IMAGE_FILE_LINE_NUMS_STRIPPED       0x0004  // Line nunbers stripped from file.#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.#define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Aggressively trim working set#define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.#define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.#define IMAGE_FILE_DEBUG_STRIPPED           0x0200  // Debugging info stripped from file in .DBG file#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.#define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.#define IMAGE_FILE_SYSTEM                   0x1000  // System File.#define IMAGE_FILE_DLL                       0x2000  // File is a DLL.#define IMAGE_FILE_UP_SYSTEM_ONLY           0x4000  // File should only be run on a UP machine#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.

// Optional header format.//
typedef struct _IMAGE_OPTIONAL_HEADER {   //   // Standard fields.   //
   WORD    Magic;   BYTE    MajorLinkerVersion;   BYTE    MinorLinkerVersion;   DWORD   SizeOfCode;   DWORD   SizeOfInitializedData;   DWORD   SizeOfUninitializedData;   DWORD   AddressOfEntryPoint;   DWORD   BaseOfCode;   DWORD   BaseOfData;
   //   // NT additional fields.   //
   DWORD   ImageBase;   DWORD   SectionAlignment;   DWORD   FileAlignment;   WORD    MajorOperatingSystemVersion;   WORD    MinorOperatingSystemVersion;   WORD    MajorImageVersion;   WORD    MinorImageVersion;   WORD    MajorSubsystemVersion;   WORD    MinorSubsystemVersion;   DWORD   Win32VersionValue;   DWORD   SizeOfImage;   DWORD   SizeOfHeaders;   DWORD   CheckSum;   WORD    Subsystem;   WORD    DllCharacteristics;   DWORD   SizeOfStackReserve;   DWORD   SizeOfStackCommit;   DWORD   SizeOfHeapReserve;   DWORD   SizeOfHeapCommit;   DWORD   LoaderFlags;   DWORD   NumberOfRvaAndSizes;   IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

0x10B: 32位镜像文件
0x107: ROM镜像文件
0x20B: 64位镜像文件

// DllCharacteristics Entries
//     IMAGE_LIBRARY_PROCESS_INIT           0x0001     // Reserved.//     IMAGE_LIBRARY_PROCESS_TERM           0x0002     // Reserved.//     IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.//     IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA   0x0020  // Image can handle a high entropy 64-bit virtual address space.#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040     // DLL can move.#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY   0x0080     // Code Integrity Image#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT   0x0100     // Image is NX compatible#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200     // Image understands isolation and doesn't want it#define IMAGE_DLLCHARACTERISTICS_NO_SEH       0x0400     // Image does not use SEH. No SE handler may reside in this image#define IMAGE_DLLCHARACTERISTICS_NO_BIND     0x0800     // Do not bind this image.#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000     // Image should execute in an AppContainer#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER   0x2000     // Driver uses WDM model#define IMAGE_DLLCHARACTERISTICS_GUARD_CF     0x4000     // Image supports Control Flow Guard.#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE     0x8000

struct IMAGE_DATA_DIRECTORY_ARRAY DataDirArray //指向的是一个指针，里面的内容指向的是描述表   struct IMAGE_DATA_DIRECTORY Import  //里面包含了导入表的起始地址和大小。       DWORD VirtualAddress  //指向导入表的起始地址在内存中的虚拟地址。       DWORD Size            //导入表的大小，以字节为单位。
struct IMAGE_IMPORT_DESCRIPTOR ImportDescriptor[0] //里面有dll和函数的地址

typedef struct _IMAGE_SECTION_HEADER {   BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];   union {           DWORD   PhysicalAddress;           DWORD   VirtualSize;  } Misc;   DWORD   VirtualAddress;   DWORD   SizeOfRawData;   DWORD   PointerToRawData;   DWORD   PointerToRelocations;   DWORD   PointerToLinenumbers;   WORD    NumberOfRelocations;   WORD    NumberOfLinenumbers;   DWORD   Characteristics;} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

#include <stdio.h>#include <stdlib.h>#include <Windows.h>#include <winnt.h>#pragma warning(disable:4996)void* load_PE(char* PE_data);void fix_iat(char*, IMAGE_NT_HEADERS*);void fix_base_reloc(char* p_image_base, IMAGE_NT_HEADERS* p_NT_headers);
int main(int argc, char const* argv[]) {if (argc < 2) {printf("missing path argumentn");return 1;}FILE* exe_file = fopen(argv[1], "rb");if (!exe_file) {printf("error opening filen");return 1;}// Get file size : put pointer at the endfseek(exe_file, 0L, SEEK_END);// and read its positionlong int file_size = ftell(exe_file);// put the pointer back at the beginningfseek(exe_file, 0L, SEEK_SET);// allocate memory and read the whole filechar* exe_file_data = (char*)malloc(file_size + 1);// read whole filesize_t n_read = fread(exe_file_data, 1, file_size, exe_file);if (n_read != file_size) {printf("reading error (%d)n", n_read);return 1;}// load the PE in memoryprintf("[+] Loading PE filen");//pe里面有个导入表//字典 里面不仅要有内容 还要有内容对应的名称void* entry = load_PE(exe_file_data);if (entry != NULL) {// call its entrypoint((void (*)(void))entry)();}return 0;}
void* load_PE(char* PE_data) {IMAGE_DOS_HEADER* p_DOS_header = (IMAGE_DOS_HEADER*)PE_data;IMAGE_NT_HEADERS* p_NT_headers = (IMAGE_NT_HEADERS*)(PE_data + p_DOS_header -> e_lfanew);// extract information from PE headerDWORD size_of_image = p_NT_headers->OptionalHeader.SizeOfImage;DWORD entry_point_RVA = p_NT_headers->OptionalHeader.AddressOfEntryPoint;DWORD size_of_headers = p_NT_headers->OptionalHeader.SizeOfHeaders;// allocate memory// https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi•virtualallocchar* p_image_base = (char*)VirtualAlloc(NULL, size_of_image, MEM_RESERVE |MEM_COMMIT, PAGE_READWRITE);if (p_image_base == NULL) {return NULL;}// copy PE headers in memorymemcpy(p_image_base, PE_data, size_of_headers);// Section headers starts right after the IMAGE_NT_HEADERS struct, so we do somepointer arithmetic - fu here.IMAGE_SECTION_HEADER * sections = (IMAGE_SECTION_HEADER*)(p_NT_headers + 1);for (int i = 0; i < p_NT_headers->FileHeader.NumberOfSections; i++) {// calculate the VA we need to copy the content, from the RVA// section[i].VirtualAddress is a RVA, mind itchar* dest = p_image_base + sections[i].VirtualAddress;// check if there is Raw data to copyif (sections[i].SizeOfRawData > 0) {// We copy SizeOfRaw data bytes, from the offset PointerToRawData in thefilememcpy(dest, PE_data + sections[i].PointerToRawData,sections[i].SizeOfRawData);}else {memset(dest, 0, sections[i].Misc.VirtualSize);}}fix_iat(p_image_base, p_NT_headers);fix_base_reloc(p_image_base, p_NT_headers);// Set permission for the PE header to read onlyDWORD oldProtect;VirtualProtect(p_image_base, p_NT_headers->OptionalHeader.SizeOfHeaders,PAGE_READONLY, &oldProtect);for (int i = 0; i < p_NT_headers->FileHeader.NumberOfSections; ++i) {char* dest = p_image_base + sections[i].VirtualAddress;DWORD s_perm = sections[i].Characteristics;DWORD v_perm = 0; // flags are not the same between virtal protect and thesection headerif (s_perm & IMAGE_SCN_MEM_EXECUTE) {v_perm = (s_perm & IMAGE_SCN_MEM_WRITE) ? PAGE_EXECUTE_READWRITE :PAGE_EXECUTE_READ;}else {v_perm = (s_perm & IMAGE_SCN_MEM_WRITE) ? PAGE_READWRITE :PAGE_READONLY;}VirtualProtect(dest, sections[i].Misc.VirtualSize, v_perm, &oldProtect);}return (void*)(p_image_base + entry_point_RVA);}
void fix_iat(char* p_image_base, IMAGE_NT_HEADERS* p_NT_headers) {IMAGE_DATA_DIRECTORY* data_directory = p_NT_headers -> OptionalHeader.DataDirectory;// load the address of the import descriptors arrayIMAGE_IMPORT_DESCRIPTOR* import_descriptors =(IMAGE_IMPORT_DESCRIPTOR*)(p_image_base +data_directory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);// this array is null terminatedfor (int i = 0; import_descriptors[i].OriginalFirstThunk != 0; ++i) {// Get the name of the dll, and import itchar* module_name = p_image_base + import_descriptors[i].Name;HMODULE import_module = LoadLibraryA(module_name);if (import_module == NULL) {printf("import module is null");abort();}// the lookup table points to function names or ordinals => it is the IDTIMAGE_THUNK_DATA* lookup_table = (IMAGE_THUNK_DATA*)(p_image_base +import_descriptors[i].OriginalFirstThunk);// the address table is a copy of the lookup table at first// but we put the addresses of the loaded function inside => that's the IATIMAGE_THUNK_DATA* address_table = (IMAGE_THUNK_DATA*)(p_image_base +import_descriptors[i].FirstThunk);// null terminated array, againfor (int i = 0; lookup_table[i].u1.AddressOfData != 0; ++i) {void* function_handle = NULL;// Check the lookup table for the adresse of the function name to importDWORD lookup_addr = lookup_table[i].u1.AddressOfData;if ((lookup_addr & IMAGE_ORDINAL_FLAG) == 0) { // if first bit is not 1// import by name : get the IMAGE_IMPORT_BY_NAME structIMAGE_IMPORT_BY_NAME* image_import = (IMAGE_IMPORT_BY_NAME*)(p_image_base + lookup_addr);// this struct points to the ASCII function namechar* funct_name = (char*)&(image_import->Name);// get that function address from it's module and namefunction_handle = (void*)GetProcAddress(import_module, funct_name);}else {// import by ordinal, directlyfunction_handle = (void*)GetProcAddress(import_module,(LPSTR)lookup_addr);}if (function_handle == NULL) {printf("function handle is null");abort();}// change the IAT, and put the function address inside.address_table[i].u1.Function = (DWORD)function_handle;}}}
void fix_base_reloc(char* p_image_base, IMAGE_NT_HEADERS* p_NT_headers) {IMAGE_DATA_DIRECTORY* data_directory = p_NT_headers -> OptionalHeader.DataDirectory;// this is how much we shifted the ImageBaseDWORD delta_VA_reloc = ((DWORD)p_image_base) - p_NT_headers -> OptionalHeader.ImageBase;// if there is a relocation table, and we actually shitfted the ImageBaseif (data_directory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress != 0 &&delta_VA_reloc != 0) {// calculate the relocation table addressIMAGE_BASE_RELOCATION* p_reloc =(IMAGE_BASE_RELOCATION*)(p_image_base +data_directory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);// once again, a null terminated arraywhile (p_reloc->VirtualAddress != 0) {// how any relocation in this block// ie the total size, minus the size of the "header", divided by 2(those are words, so 2 bytes for each)DWORD size = (p_reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2;// the first relocation element in the block, right after the header(using pointer arithmetic again)WORD* fixups = (WORD*)(p_reloc + 1);for (int i = 0; i < size; ++i) {// type is the first 4 bits of the relocation wordint type = fixups[i] >> 12;// offset is the last 12 bitsint offset = fixups[i] & 0x0fff;// this is the address we are going to changeDWORD* change_addr = (DWORD*)(p_image_base + p_reloc->VirtualAddress+ offset);