PE格式详细讲解2-系统篇02

（注：最左边是文件头的偏移量。） 
IMAGE_DOS_HEADER STRUCT 
{ 
+0h     WORD     e_magic        //    Magic DOS signature MZ(4Dh 5Ah)     DOS可执行文件标记 
+2h     WORD     e_cblp           //    Bytes on last page of file               
+4h     WORD     e_cp            //    Pages in file                     
+6h     WORD     e_crlc            //    Relocations                     
+8h     WORD     e_cparhdr      //    Size of header in paragraphs         
+0ah    WORD     e_minalloc     //    Minimun extra paragraphs needs         
+0ch    WORD     e_maxalloc     //    Maximun extra paragraphs needs     
+0eh    WORD     e_ss           //    intial(relative)SS value            DOS代码的初始化堆栈SS 
+10h    WORD     e_sp            //    intial SP value                     DOS代码的初始化堆栈指针SP 
+12h    WORD     e_csum            //    Checksum 
+14h    WORD     e_ip            //   intial IP value               DOS代码的初始化指令入口[指针IP] 
+16h    WORD     e_cs            //    intial(relative)CS value            DOS代码的初始堆栈入口 
+18h    WORD     e_lfarlc        //    File Address of relocation table 
+1ah    WORD     e_ovno         //   Overlay number 
+1ch    WORD     e_res[4]        //   Reserved words 
+24h    WORD     e_oemid        //   OEM identifier(for e_oeminfo) 
+26h    WORD     e_oeminfo      //   OEM information;e_oemid specific  
+29h    WORD     e_res2[10]     //   Reserved words 
+3ch    DWORD    e_lfanew       //   Offset to start of PE header        指向PE文件头 
} IMAGE_DOS_HEADER ENDS

IMAGE_NT_HEADERS STRUCT 
{
+0h DWORDSignature +4h IMAGE_FILE_HEADER FileHeader +18h IMAGE_OPTIONAL_HEADER32OptionalHeader } IMAGE_NT_HEADERS ENDS

typedef     struct _IMAGE_FILE_HEADER 
{
+04h    WORD          Machine;              // 运行平台
+06h    WORD          NumberOfSections;     // 文件的区块数目
+08h    DWORD         TimeDateStamp;        // 文件创建日期和时间
+0Ch    DWORD         PointerToSymbolTable; // 指向符号表(主要用于调试)
+10h    DWORD         NumberOfSymbols;      // 符号表中符号个数(同上)
+14h    WORD          SizeOfOptionalHeader; // IMAGE_OPTIONAL_HEADER32 结构大小
+16h    WORD          Characteristics;      // 文件属性
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;