pe.pro |
|
 |
pe |
MSDN Portable Executable & Common Object File Format Specification |
 |
field -pe_start |
 |
 |
integer |
|
 |
offset to the pe stub |
 |
 |
 |
pe_stub |
|
 |
field -signature |
 |
 |
string(fixed) |
'PE\0\0' |
 |
|
 |
field -machine |
 |
 |
sparelist |
0x14c |
 |
|
 |
field -nbSections |
 |
 |
integer |
|
 |
|
 |
field -timestamp |
 |
 |
integer |
|
 |
|
 |
field -ptrSymbolTable |
 |
 |
integer |
|
 |
|
 |
field -nbSymbols |
 |
 |
integer |
|
 |
|
 |
field -sizeOptionalHeader |
 |
 |
integer |
|
 |
|
 |
field -characteristics |
 |
 |
flags |
|
 |
|
 |
field -optional |
 |
 |
mapper(pe_stub_optional_header) |
|
 |
|
 |
fieldarray -sections |
 |
 |
mapper(pe_stub_section) |
|
 |
|
 |
 |
 |
pe_stub_optional_header |
|
 |
field -magic |
 |
 |
sparelist |
0x010b |
 |
|
 |
field -majorLinker |
 |
 |
integer |
|
 |
|
 |
field -minorLinker |
 |
 |
integer |
|
 |
|
 |
field -sizeCode |
 |
 |
integer |
|
 |
|
 |
field -sizeData |
 |
 |
integer |
|
 |
|
 |
field -sizeBSS |
 |
 |
integer |
|
 |
|
 |
field -entryPoint |
 |
 |
integer |
|
 |
|
 |
field -baseCode |
 |
 |
integer |
|
 |
|
 |
field -baseData |
 |
 |
integer |
|
 |
|
 |
field -imageBase |
 |
 |
integer |
|
 |
|
 |
field -imageBaseHi |
 |
 |
integer |
|
 |
|
 |
field -imageBaseLow |
 |
 |
integer |
|
 |
|
 |
field -sectionAlignment |
 |
 |
integer |
|
 |
|
 |
field -fileAlignment |
 |
 |
integer |
|
 |
|
 |
field -majorOS |
 |
 |
integer |
|
 |
|
 |
field -minorOS |
 |
 |
integer |
|
 |
|
 |
field -majorImage |
 |
 |
integer |
|
 |
|
 |
field -minorImage |
 |
 |
integer |
|
 |
|
 |
field -majorSubsystem |
 |
 |
integer |
|
 |
|
 |
field -minorSubsystem |
 |
 |
integer |
|
 |
|
 |
field -reserved |
 |
 |
integer |
|
 |
|
 |
field -sizeImage |
 |
 |
integer |
|
 |
|
 |
field -sizeHeaders |
 |
 |
integer |
|
 |
|
 |
field -checksum |
 |
 |
integer |
|
 |
|
 |
field -subsystem |
 |
 |
list |
|
 |
|
 |
field -dllCharacteristics |
 |
 |
flags |
|
 |
|
 |
field -sizeStackReserve |
 |
 |
integer |
|
 |
|
 |
field -sizeStackCommit |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapReserve |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapCommit |
 |
 |
integer |
|
 |
|
 |
field -sizeStackReserveHi |
 |
 |
integer |
|
 |
|
 |
field -sizeStackReserveLow |
 |
 |
integer |
|
 |
|
 |
field -sizeStackCommitHi |
 |
 |
integer |
|
 |
|
 |
field -sizeStackCommitLow |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapReserveHi |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapReserveLow |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapCommitHi |
 |
 |
integer |
|
 |
|
 |
field -sizeHeapCommitLow |
 |
 |
integer |
|
 |
|
 |
field -loadFlags |
 |
 |
integer |
|
 |
obsolete |
 |
field -nbRVAandSizes |
 |
 |
integer |
|
 |
|
 |
field -dataDirectories |
 |
 |
mapper(pe_stub_data_directories) |
|
 |
|
 |
 |
 |
pe_stub_data_directories |
|
 |
field -exportTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -importTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -resourceTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -execptionTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -certificateTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -baseRelocationTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -debug |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -architecture |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -globalPtr |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -TLSTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -loadConfigTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -boundImport |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -importAddrTable |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -delayImportDescriptor |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -COM+RuntimeHeader |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
field -reserved |
 |
 |
mapper(pe_stub_data_directory) |
|
 |
|
 |
 |
 |
pe_stub_data_directory |
|
 |
field -rva |
 |
 |
integer |
|
 |
|
 |
field -size |
 |
 |
integer |
|
 |
|
 |
 |
 |
pe_stub_section |
|
 |
field -name |
 |
 |
string(fixed) |
|
 |
|
 |
field -virtualSize |
 |
 |
integer |
|
 |
|
 |
field -virtualAddress |
 |
 |
integer |
|
 |
|
 |
field -sizeRawData |
 |
 |
integer |
|
 |
|
 |
field -ptrRawData |
 |
 |
integer |
|
 |
|
 |
field -nbRelocations |
 |
 |
integer |
|
 |
|
 |
field -ptrRelocations |
 |
 |
integer |
|
 |
|
 |
field -nbLineNumbers |
 |
 |
integer |
|
 |
|
 |
field -ptrLineNumbers |
 |
 |
integer |
|
 |
|
 |
field -characteristics |
 |
 |
flags |
|
 |
|
 |
field -alignment |
 |
 |
list |
|
 |
|
 |
field -content |
 |
 |
blob |
|
 |
|
 |
 |
 |
pe_import |
|
 |
field -lookupTableRVA |
 |
 |
integer |
0 |
 |
|
 |
field -timestamp |
 |
 |
integer |
0 |
 |
|
 |
field -forward |
 |
 |
integer |
0 |
 |
|
 |
field -nameRVA |
 |
 |
integer |
0 |
 |
|
 |
field -importAddrTableRVA |
 |
 |
integer |
0 |
 |
|
 |
 |