le.txt

EXE文件结构说明.老而经典的资料.希望对大家有帮助.

struct LEHeader {
	ushort	magic_le;	// 00 - should be 'EL' (LE backwards)
	boolean	byte_order;	// 02 - byte order
	boolean	word_order;	// 03 - word order
	ulong	format_level;	// 04 - format level
	ushort	cpu_type;	// 08 - CPU type req'd
	ushort	os_type;	// 0a - OS type req'd
	ulong	module_version;	// 0c - version of module
	ulong	module_flags;	// 10 - module flags
	ulong	module_pages;	// 14 - # of pages in this module
	ulong	EIP_object;	// 18 - object EIP offset refers to
	ulong	EIP_offset;	// 1c - EIP offset within that object
	ulong	ESP_object;	// 20 - object ESP offset refers to
	ulong	ESP_offset;	// 24 - ESP offset within that object
	ulong	page_size;	// 28 - page size, in bytes
	ulong	final_page;	// 2c - # of bytes in final 4k image page, 0->4095
	ulong	relosize;	// 30 - length of relocation section
	ulong	relochk;	// 34 - relocation checksum (not used)
	ulong	loadersize;	// 38 - loader section size
	ulong	loaderchk;	// 3c - loader section checksum
	ulong	object_offset;	// 40 - offset to object table - from LE header
	ulong	object_cnt;	// 44 - # of objects in object table
	ulong	objpage_offset;	// 48 - offset to object page table
	ulong	objipg_offset;	// 4c - offset to object iterated page table
	ulong	resrc_offset;	// 50 - offset to resource table
	ulong	resrc_entries;	// 54 - # of entries in resource table
	ulong	name_offset;	// 58 - offset to name
	ulong	entry_tbl;	// 5c - entry name table offset
	ulong	dirctv_off;	// 60 - directive table offset
	ulong	dirctv_cnt;	// 64 - directive table count
	ulong	relooffs_tbl;	// 68 - relocation page table offset - offsets to relocs for each page
	ulong	relopage_tbl;	// 6c - relocation page number table offset
	ulong	impname_tbl;	// 70 - import module name table offset
	ulong	impname_cnt;	// 74 - # of entries in import module name table
	ulong	impproc_tbl;	// 78 - import procedure table offset
	ulong	pagechk_tbl;	// 7c - per-page checksum table offset
	ulong	image_start;	// 80 - absolute file offset of image
	ulong	preload_pages;	// 84 - # of pages to preload
	ulong	nonres_tbl;	// 88 - nonresident name table offset
	ulong	nonres_len;	// 8c - nonresident name table length
	ulong	nonres_chk;	// 90 - nonresident name table checksum
	ulong	autods_obj;	// 94 - auto-ds object -- unused for 32-bit exe's
	ulong	debug_off;	// 98 - offset to debug info
	ulong	debug_len;	// 9c - length of debug info
	ulong	inst_preload;	// a0 - # of instance data pages in preload section
	ulong	inst_demand;	// a4 - # of instance data pages in demand section
	ulong	heapsize;	// a8 - heap size to add to auto-ds segment - unused for 32-bit exe's
};

struct LEModule {
	struct LEModule *next;
	struct LEHeader leh;
};

struct	LEObject {
	ulong	size;		// size - what more can I say?
	ulong	rbase_addr;	// relocation base address - address obj currently relocated to
	ulong	flags;		// flags
	ulong	first_page;	// first page # in page number table
	ulong	pagecnt;	// # of entries in page # table for this object
	ulong	segment;	// really a reserved, but internal pointer for me
};

#define	RB_SIZE (4096)

struct	RelocBlock {
	struct RelocBlock *next;
	ulong	numrelocs;
	ulong	relocs[RB_SIZE];
};