winexe.txt

windows exe文件的结构、初始化

Type Information

The TYPEINFO structure has the following form: 
typedef struct _TYPEINFO {
    WORD        rtTypeID;
    WORD        rtResourceCount;
    DWORD       rtReserved;
    NAMEINFO    rtNameInfo[];
} TYPEINFO;
Following are the members in the TYPEINFO structure: 
rtTypeID       Specifies the type identifier of the resource. 
               This integer value is either a resource-type 
               value or an offset to a resource-type name. If 
               the high bit in this member is set (0x8000), 
               the value is one of the following resource-type 
               values: 

               Value            Resource type

               RT_ACCELERATOR   Accelerator table 
               RT_BITMAP        Bitmap 
               RT_CURSOR        Cursor 
               RT_DIALOG        Dialog box 
               RT_FONT          Font component 
               RT_FONTDIR       Font directory 
               RT_GROUP_CURSOR  Cursor directory 
               RT_GROUP_ICON    Icon directory 
               RT_ICON          Icon 
               RT_MENU          Menu 
               RT_RCDATA        Resource data 
               RT_STRING        String table 
               If the high bit of the value in this member is 
               not set, the value represents an offset, in 
               bytes relative to the beginning of the resource 
               table, to a name in the rscResourceNames
               member. 
rtResourceCount    Specifies the number of resources of this 
               type in the executable file. 
rtReserved     Reserved. 
rtNameInfo     Specifies an array of	NAMEINFO structures 
               containing information about individual 
               resources. The rtResourceCount member specifies 
               the number of structures in the array. 

Name Information

The NAMEINFO structure has the following form: 
typedef struct _NAMEINFO {
    WORD rnOffset;
    WORD rnLength;
    WORD rnFlags;
    WORD rnID;
    WORD rnHandle;
    WORD rnUsage;
} NAMEINFO;
Following are the members in the NAMEINFO structure: 
rnOffset Specifies an offset to the contents of the resource 
         data (relative to the beginning of the file). The 
         offset is in terms of alignment units specified by 
         the rscAlignShift member at the beginning of the 
         resource table. 
rnLength Specifies the resource length, in bytes. 
rnFlags  Specifies whether the resource is fixed, preloaded, 
         or shareable. This member can be one or more of the 
         following values: 

         Value  Meaning

         0x0010 Resource is movable (MOVEABLE). Otherwise, it 
                is fixed. 
         0x0020 Resource can be shared (PURE). 
         0x0040 Resource is preloaded (PRELOAD). Otherwise, it 
                is loaded on demand. 
rnID     Specifies or points to the resource identifier. If 
         the identifier is an integer, the high bit is set 
         (8000h). Otherwise, it is an offset to a resource 
         string, relative to the beginning of the resource 
         table. 
rnHandle Reserved. 
rnUsage  Reserved. 

Resident-Name Table

The resident-name table contains strings that identify 
exported functions in the executable file. As the name 
implies, these strings are resident in system memory and are 
never discarded. The resident-name strings are case-sensitive 
and are not null-terminated. The following list summarizes 
the values found in the resident-name table (the locations 
are relative to the beginning of each entry): 

Location Description

00h      Specifies the length of a string. If there are no 
         more strings in the table, this value is zero. 
01h - xxhSpecifies the resident-name text. This string is 
         case-sensitive and is not null-terminated. 
xxh + 01hSpecifies an ordinal number that identifies the 
         string. This number is an index into the entry table. 
The first string in the resident-name table is the module 
name. 

Module-Reference Table

The module-reference table contains offsets for module names 
stored in the imported-name table. Each entry in this table 
is 2 bytes long. 

Imported-Name Table

The imported-name table contains the names of modules that 
the executable file imports. Each entry contains two parts: a 
single byte that specifies the length of the string and the 
string itself. The strings in this table are not 
null-terminated. 

Entry Table

The entry table contains bundles of entry points from the 
executable file (the linker generates each bundle). The 
numbering system for these ordinal values is 1-based--that 
is, the ordinal value corresponding to the first entry point 
is 1. 
The linker generates the densest possible bundles under the 
restriction that it cannot reorder the entry points. This 
restriction is necessary because other executable files may 
refer to entry points within a given bundle by their ordinal 
values. 
The entry-table data is organized by bundle, each of which 
begins with a 2-byte header. The first byte of the header 
specifies the number of entries in the bundle (a value of 00h 
designates the end of the table). The second byte specifies 
whether the corresponding segment is movable or fixed. If the 
value in this byte is 0FFh, the segment is movable. If the 
value in this byte is 0FEh, the entry does not refer to a 
segment but refers, instead, to a constant defined within the 
module. If the value in this byte is neither 0FFh nor 0FEh, 
it is a segment index. 

For movable segments, each entry consists of 6 bytes and has 
the following form: 

Location Description

00h      Specifies a byte value. This value can be a 
         combination of the following bits: 

         Bit(s)    Meaning

         0     If this bit is set, the entry is exported. 
         1     If this bit is set, the segment uses a global 
               (shared) data segment. 
         3-7   If the executable file contains code that 
               performs ring transitions, these bits specify 
               the number of words that compose the stack. At 
               the time of the ring transition, these words 
               must be copied from one ring to the other. 
01h      Specifies an int 3fh instruction. 
03h      Specifies the segment number. 
04h      Specifies the segment offset. 

For fixed segments, each entry consists of 3 bytes and has the 
following form: 

Location Description

00h      Specifies a byte value. This value can be a 
         combination of the following bits: 

         Bit(s)    Meaning

         0     If this bit is set, the entry is exported. 
         1     If this bit is set, the entry uses a global 
               (shared) data segment. (This may be set only 
               for SINGLEDATA library modules.) 
         3-7   If the executable file contains code that 
               performs ring transitions, these bits specify 
               the number of words that compose the stack. At 
               the time of the ring transition, these words 
               must be copied from one ring to the other. 
01h      Specifies an offset. 

Nonresident-Name Table

The nonresident-name table contains strings that identify 
exported functions in the executable file. As the name 
implies, these strings are not always resident in system 
memory and are discardable. The nonresident-name strings are 
case-sensitive; they are not null-terminated. The following 
list summarizes the values found in the nonresident-name 
table (the specified locations are relative to the beginning 
of each entry): 

Location Description

00h      Specifies the length, in bytes, of a string. If this 
         byte is 00h, there are no more strings in the table. 
01h - xxhSpecifies the nonresident-name text. This string is 
         case-sensitive and is not null-terminated. 
xx + 01h Specifies an ordinal number that is an index to the 
         entry table. 
The first name that appears in the nonresident-name table is 
the module description string (which was specified in the 
module-definition file). 

Code Segments and Relocation Data

Code and data segments follow the Windows header. Some of the 
code segments may contain calls to functions in other 
segments and may, therefore, require relocation data to 
resolve those references. This relocation data is stored in a 
relocation table that appears immediately after the code or 
data in the segment. The first 2 bytes in this table specify 
the number of relocation items the table contains. A 
relocation item is a collection of bytes specifying the 
following information: 
  Address type (segment only, offset only, segment and 
  offset) 
  Relocation type (internal reference, imported ordinal, 
  imported name) 
  Segment number or ordinal identifier (for internal 
  references) 
  Reference-table index or function ordinal number (for 
  imported ordinals) 
  Reference-table index or name-table offset (for imported 
  names) 
Each relocation item contains 8 bytes of data, the first byte 
of which specifies one of the following relocation-address 
types: 

Value  Meaning

0      Low byte at the specified offset 
2      16-bit selector 
3      32-bit pointer 
5      16-bit offset 
11     48-bit pointer 
13     32-bit offset 
The second byte specifies one of the following relocation 
types: 

Value  Meaning

0      Internal reference 
1      Imported ordinal 
2      Imported name 
3      OSFIXUP
The third and fourth bytes specify the offset of the 
relocation item within the segment. 
If the relocation type is imported ordinal, the fifth and 
sixth bytes specify an index to a module's reference table and 
the seventh and eighth bytes specify a function ordinal value. 
If the relocation type is imported name, the fifth and sixth 
bytes specify an index to a module's reference table and the 
seventh and eighth bytes specify an offset to an imported-name 
table. 
If the relocation type is internal reference and the segment 
is fixed, the fifth byte specifies the segment number, the 
sixth byte is zero, and the seventh and eighth bytes specify 
an offset to the segment. If the relocation type is internal 
reference and the segment is movable, the fifth byte specifies 
0FFh, the sixth byte is zero; and the seventh and eighth bytes 
specify an ordinal value found in the segment's entry table.