pefile.txt

详细介绍WINDOWS PE文件格式

download : http://topage.126.com    


 The Portable Executable File Format from Top to Bottom

 Randy Kath
 Microsoft Developer Network Technology Group

 Abstract

 The Windows NT version 3.1 operating system introduces a new executable file
 format called the Portable Executable (PE) file format. The Portable Executable
 File Format specification, though rather vague, has been made available to the
 public and is included on the Microsoft Developer Network CD (Specs and
 Strategy, Specifications, Windows NT File Format Specifications).

 Yet this specification alone does not provide enough information to make it
 easy, or even reasonable, for developers to understand the PE file format. This
 article is meant to address that problem. In it you'll find a thorough
 explanation of the entire PE file format, along with descriptions of all the
 necessary structures and source code examples that demonstrate how to use this
 information.

 All of the source code examples that appear in this article are taken from a
 dynamic-link library (DLL) called PEFILE.DLL. I wrote this DLL simply for the
 purpose of getting at the important information contained within a PE file. The
 DLL and its source code are also included on this CD as part of the PEFile
 sample application; feel free to use the DLL in your own applications. Also,
 feel free to take the source code and build on it for any specific purpose you
 may have. At the end of this article, you'll find a brief list of the functions
 exported from the PEFILE.DLL and an explanation of how to use them. I think
 you'll find these functions make understanding the PE file format easier to
 cope with.

 Introduction

 The recent addition of the Microsoft