MZ exe가 끝나는 곳을 결정하고 LE/LX/PE가 시작됩니다.

Question

EXE 파일의 MZ 부분이 끝나는 곳을 결정하는 가장 좋은 방법은 무엇일까 궁금합니다. PE/LE/LX/NE 일 수 있습니다./COFF 등 ...).

나는이 웹 사이트를 찾았습니다 : http://www.delorie.com/djgpp/doc/exe/이 사이트는 그것을 설명하려고 시도하지만 기대했던 결과를 얻지 못했습니다. 나는 항상 실제 PE 또는 LX 시작 오프셋을 넘는 오프셋 방법으로 끝납니다.

// LXInfo.cpp : Defines the entry point for the console application. 
// 

#include "stdafx.h" 

struct EXE { 
    unsigned short signature; /* == 0x5a4D */ 
    unsigned short bytes_in_last_block; 
    unsigned short blocks_in_file; 
    unsigned short num_relocs; 
    unsigned short header_paragraphs; 
    unsigned short min_extra_paragraphs; 
    unsigned short max_extra_paragraphs; 
    unsigned short ss; 
    unsigned short sp; 
    unsigned short checksum; 
    unsigned short ip; 
    unsigned short cs; 
    unsigned short reloc_table_offset; 
    unsigned short overlay_number; 
}; 

struct EXE_RELOC { 
    unsigned short offset; 
    unsigned short segment; 
}; 


int _tmain(int argc, _TCHAR* argv[]) 
{ 
    struct EXE header1; 
    char sFile[]="c:\\register.dll"; 
    unsigned int extra_data_start; 
    char test; 
    FILE *fp; 
    fp = fopen(sFile, "rb"); 
    fread(&header1,sizeof(struct EXE),1,fp); 

    //read the header 
    printf("EXE Signature: %x \n", header1.signature); 
    printf("Bytes in last block: %08x \n", header1.bytes_in_last_block); 
    printf("Blocks in file: %08x \n", header1.blocks_in_file); 
    printf("Number of relocations: %08x \n", header1.num_relocs); 
    printf("Header paragraphs: %08x \n", header1.header_paragraphs); 
    printf("Min. extra paragraphs: %08x \n", header1.min_extra_paragraphs); 
    printf("Max. extra paragraphs: %08x \n", header1.max_extra_paragraphs); 
    printf("Initial SS value: %08x \n", header1.ss); 
    printf("Initial SP value: %08x \n", header1.sp); 
    printf("Checksum value: %08x \n", header1.checksum); 
    printf("Initial CS value: %08x \n", header1.cs); 
    printf("Initial IP value: %08x \n", header1.ip); 
    printf("Relocation table offset: %08x \n", header1.reloc_table_offset); 
    printf("Overlay number: %x \n", header1.overlay_number); 
    printf("\n"); 
    printf("Start of EXE data: %08x \n", header1.header_paragraphs * 16L); 

    //calculate end of MZ EXE, according to Delorie 
    extra_data_start = header1.blocks_in_file * 512L; 
    if (header1.bytes_in_last_block) 
     extra_data_start -= (512 - header1.bytes_in_last_block); 

    printf("End of EXE data: %08x \n", extra_data_start); 

    // let's read the first two bytes after the MZ EXE data. This should give us a P and E on windows, or L and X on OS/2... 
    fseek(fp,extra_data_start,SEEK_SET); 
    fread(&test,1,1,fp); 
    printf("test char: %c \n", test); 
    fread(&test,1,1,fp); 
    printf("test char: %c \n", test); 

    fclose(fp); 
    getch(); 
    return 0; 
} 

Answer 1

An In-Depth Look into the Win32 Portable Executable File Format 읽기.
또한 오프셋을 얻기 위해, 예를 들어 The Portable Executable File Format

에 읽어해야 IMAGE_NT_HEADERS 당신은 다음과 같이 할 것 :

IMAGE_DOS_HEADER* pdos = (IMAGE_DOS_HEADER*)peBuffer; 
IMAGE_NT_HEADERS* pnt = (IMAGE_NT_HEADERS*)((DWORD)pdos + pdos->e_lfanew);