pe.pro |
|
|
pe |
MSDN Portable Executable & Common Object File Format Specification |
|
field -pe_start |
|
|
integer |
|
|
offset to the pe stub |
|
|
|
pe_stub |
|
|
field -signature |
|
|
string(fixed) |
'PE\0\0' |
|
|
|
field -machine |
|
|
sparelist |
0x14c |
|
|
|
field -nbSections |
|
|
integer |
|
|
|
|
field -timestamp |
|
|
integer |
|
|
|
|
field -ptrSymbolTable |
|
|
integer |
|
|
|
|
field -nbSymbols |
|
|
integer |
|
|
|
|
field -sizeOptionalHeader |
|
|
integer |
|
|
|
|
field -characteristics |
|
|
flags |
|
|
|
|
field -optional |
|
|
mapper(pe_stub_optional_header) |
|
|
|
|
fieldarray -sections |
|
|
mapper(pe_stub_section) |
|
|
|
|
|
|
pe_stub_optional_header |
|
|
field -magic |
|
|
sparelist |
0x010b |
|
|
|
field -majorLinker |
|
|
integer |
|
|
|
|
field -minorLinker |
|
|
integer |
|
|
|
|
field -sizeCode |
|
|
integer |
|
|
|
|
field -sizeData |
|
|
integer |
|
|
|
|
field -sizeBSS |
|
|
integer |
|
|
|
|
field -entryPoint |
|
|
integer |
|
|
|
|
field -baseCode |
|
|
integer |
|
|
|
|
field -baseData |
|
|
integer |
|
|
|
|
field -imageBase |
|
|
integer |
|
|
|
|
field -imageBaseHi |
|
|
integer |
|
|
|
|
field -imageBaseLow |
|
|
integer |
|
|
|
|
field -sectionAlignment |
|
|
integer |
|
|
|
|
field -fileAlignment |
|
|
integer |
|
|
|
|
field -majorOS |
|
|
integer |
|
|
|
|
field -minorOS |
|
|
integer |
|
|
|
|
field -majorImage |
|
|
integer |
|
|
|
|
field -minorImage |
|
|
integer |
|
|
|
|
field -majorSubsystem |
|
|
integer |
|
|
|
|
field -minorSubsystem |
|
|
integer |
|
|
|
|
field -reserved |
|
|
integer |
|
|
|
|
field -sizeImage |
|
|
integer |
|
|
|
|
field -sizeHeaders |
|
|
integer |
|
|
|
|
field -checksum |
|
|
integer |
|
|
|
|
field -subsystem |
|
|
list |
|
|
|
|
field -dllCharacteristics |
|
|
flags |
|
|
|
|
field -sizeStackReserve |
|
|
integer |
|
|
|
|
field -sizeStackCommit |
|
|
integer |
|
|
|
|
field -sizeHeapReserve |
|
|
integer |
|
|
|
|
field -sizeHeapCommit |
|
|
integer |
|
|
|
|
field -sizeStackReserveHi |
|
|
integer |
|
|
|
|
field -sizeStackReserveLow |
|
|
integer |
|
|
|
|
field -sizeStackCommitHi |
|
|
integer |
|
|
|
|
field -sizeStackCommitLow |
|
|
integer |
|
|
|
|
field -sizeHeapReserveHi |
|
|
integer |
|
|
|
|
field -sizeHeapReserveLow |
|
|
integer |
|
|
|
|
field -sizeHeapCommitHi |
|
|
integer |
|
|
|
|
field -sizeHeapCommitLow |
|
|
integer |
|
|
|
|
field -loadFlags |
|
|
integer |
|
|
obsolete |
|
field -nbRVAandSizes |
|
|
integer |
|
|
|
|
field -dataDirectories |
|
|
mapper(pe_stub_data_directories) |
|
|
|
|
|
|
pe_stub_data_directories |
|
|
field -exportTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -importTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -resourceTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -execptionTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -certificateTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -baseRelocationTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -debug |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -architecture |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -globalPtr |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -TLSTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -loadConfigTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -boundImport |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -importAddrTable |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -delayImportDescriptor |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -COM+RuntimeHeader |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
field -reserved |
|
|
mapper(pe_stub_data_directory) |
|
|
|
|
|
|
pe_stub_data_directory |
|
|
field -rva |
|
|
integer |
|
|
|
|
field -size |
|
|
integer |
|
|
|
|
|
|
pe_stub_section |
|
|
field -name |
|
|
string(fixed) |
|
|
|
|
field -virtualSize |
|
|
integer |
|
|
|
|
field -virtualAddress |
|
|
integer |
|
|
|
|
field -sizeRawData |
|
|
integer |
|
|
|
|
field -ptrRawData |
|
|
integer |
|
|
|
|
field -nbRelocations |
|
|
integer |
|
|
|
|
field -ptrRelocations |
|
|
integer |
|
|
|
|
field -nbLineNumbers |
|
|
integer |
|
|
|
|
field -ptrLineNumbers |
|
|
integer |
|
|
|
|
field -characteristics |
|
|
flags |
|
|
|
|
field -alignment |
|
|
list |
|
|
|
|
field -content |
|
|
blob |
|
|
|
|
|
|
pe_import |
|
|
field -lookupTableRVA |
|
|
integer |
0 |
|
|
|
field -timestamp |
|
|
integer |
0 |
|
|
|
field -forward |
|
|
integer |
0 |
|
|
|
field -nameRVA |
|
|
integer |
0 |
|
|
|
field -importAddrTableRVA |
|
|
integer |
0 |
|
|
|
|