                                                 ͻ
                                                      Version: 1.0.0 Alpha   
                                                      Release: 27-Dec-1997y  
                                                   Created by: Hard Wisdom   
                                                 ͼ

                  PortableExecutables (PE)
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                 (  㪮⢮ ⥬ ணࠬ)



[] ঠ                                                               
~~~~~~~~~~~~~                                                               ~~~
 [0] 㯫.............................................................___
 [1] ..................................................................___
 [2]  PE 䠩 (PE Header).........................................___
 [3]  ꥪ⮢ (ᥪ権) 䠩 (Object Table).........................___
 [4] ࠭ ࠧ ᥪ権 (Image Pages)..................................___
 [5] ᯮ................................................................___
  [5.1]  ᯮ (Export Directory Table)...........................___
  [5.2]  ᮢ ᯮ (Address Table)............................___
  [5.3]  㪠⥫   (Name Table Pointers)...................___
  [5.4]  न (Ordinal Table)...................................___
  [5.5]   ᯮ (Export Name Table)...........................___
 [6] .................................................................___
  [6.1] ⠫  (Import Directory Table)............................___
  [6.2]  ᬮ  (Import LookUp Table).....................___
  [6.3]  ᮢ  (Import Address Table)......................___
 [7] 쭠   楯祪 (Thread Local Storage)................___
  [7.1]  ࠧ 楯祪 (TLS Directory table)......................___
  [7.2]   맮 楯窨 (TLS CallBack Table)...............___
 [8] ................................................................___
  [8.1] ⠫ ᮢ (Resource Directory Table).........................___
  [8.2] ਬ  ࠧ饭 ᮢ................................___
 [9]  ஥ ᮢ (FixUp Table).................................___
  [9.1]  ஥ ६饭 (FixUp Block).............................___
 [10] ⫠筠 ଠ (Debug Information).............................___
   [10.1] ⫠ ⠫ (Debug Directory)..............................___
 [11]   ᬮ७   ᠭ............................___
 [12] P.S...................................................................___

[0] 㯫
~~~~~~~~~~~~~~
   ⠪,  ⮬ 㬥   ଠ  PE  䠩    ﬨ.  
㤨   ⠪ ࠡ?   Shadow Dragon'a,     
祭 ࠡ-᫥   Windows'95.    ᭮    樠쭮
ᠭ    (쬠    쬠  ),      ४
"  ⥬  ணࠬ஢    Windows'95"  (  祭  殮  
⥭,  祭  .  .  .),      쬠  "樠쭠
Windows'95" (⮦ 祭 ),        "ணࠬ஢  
Win32 API  Windows  NT  3.5    Windows'95",    ⠪    ⮢  譨
Windows'95. 騥 ᮣ襭    ᠭ  ⥪:        
祢    -  *᪨*    ⮫쪮,  ⠫쭮  ⥪     
ந ;-),  ⥪    ६    묨  ﬨ  
᪨ 㯫ﬨ.   "?"  ⬥祭  ,  祭  
᭮,  뢠 ᮬ.

[1] 
~~~~~~~~~
   PE ଠ 䠩  祭  ,  Windows  3.11    ⠭
Win32s  ᪠ ⠪ 䠩 (  ⮣,        ⥪
⥬).  ⮫쪮    稫  쭮  ப  ࠭,  
  ७ ᯮ짮 Windows'95. ଠ 䠩 १砩  ,
 ⥬           祭    ᯮ祪,  १    
 ணࠬ,   ᠬ Windows'95 (  ணࠬ).    ⬥,
  ଠ  䠩  ᫨    筮      ⥬,   ஬   ⮣,
  堫   ଠ⮢    ⥯      ⠪  
楧 COFF ଠ OBJ  䠩,    쬠  宦    PE  (ᮡ⢥
       ;-). ,        ଠ⮬  ꥪ
㫥 ࠡ⠥ ⮫쪮 Microsoft ( ⢥, 뢠,      
।),     ᥬ   㤠, 祬  
 騪. Borland  ० ࠡ⠥     ଠ⮬  OBJ  䠩,  
 - Intel OMF (ࠢ  TASM v5.0    襫).   ⥯ 
ᠬ 䠩 ଠ.
    訫 ⠢  ᪠ 䠩 ७  EXE,    ⮡  
뫮 ஡ 砫  ᤥ ᪠ 䠩 MS-DOS.      
稫,  ⪠ 奬 :

                                                         Summary File Structure
                                                         ~~~~~~~~~~~~~~~~~~~~~~
͸
               ⠡  । ଠ                 
͵
 00h  DOS 2 Header  ⨬  (ଠ஢ ),         
                    㤥 ,   ଠ ᥬ ⥭            
Ĵ
 1Ch  4 , ࠢ騥 ଠ஢                                
         1Ch  20h,   蠥                       
       ⠬  ⢮ ;-)     ᠭ              
Ĵ
 20h  OEM Identifier  㣨 ᫮, ଠ  ணࠬ,             
      OEM Info        ࠪ᪨   ,           
                         १ࢨ஢                    
Ĵ
 3Ch  Offset to PE  饭 ॠ쭮 PE   䠩,               
         Header     DWord,                          
Ĵ
 min  ५襭 ணࠬ-誨,  ⠭⭮ STUB'            
 40h     㪠뢠 ReloOfs  DOS 2 Header, ᮮ⢥⢥  
       祭   >=40h  ⠪ 䠩    PE     
      ᬠਢ   㤥                                       
Ĵ
 min  ᮡ⢥ , ⥫ DOS ணࠬ,   STUB'a            
 40h   ᥣ    ᪠,   ᮤঠ        
  +    ᥡ 祭 ࠧ⥫ ,     PATH          
 XXh  䠩 WIN.COM  㪠   䠩, 祬              
      ।०,  筮- 쬠 ⭮. 40h              
       ࠭  , , ᮡ⢥ ,                
      室 ᪮ 㣮 ,   ࠧ             
Ĵ
 XXh  PE Header  窨 室  PE 䠩 , 㣨 ᫮,  
                 稭 ᠬ 32-⭠ ணࠬ,        
                  ஢  8-⮢ ࠭,  ⠪  㤥    
Ĵ
 XXh  Object Table  ⠡窠 ᠭ ᥪ権 䠩, ஡         
Ĵ
 XXh   Image Pages      ⠫쭠  ᪠ 䠩. . .            
         import info                                                       
         export info                                                       
         fixup info                                                        
         resource info                                                     
         debug info                                                        
         etc. . .                                                          


    ஢ન   䠩   ଠ  PE  室,  ⮡  
   EXE (  ᬥ饭 0h  ࠢ  4D5Ah    5A4Dh),   ,
᫮  ᬥ饭 18h   >=40h, ⮣  ⮫쪮  ⮣  DWord    
ᬥ饭 3Ch  .

[2]  PE 䠩 (PE Header)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⪨:
  o  VA  㠫 ,  㦥 ஢  ᬥ饭 Image Base,
     ⠭  PE Header'. RVA  ⭮⥫  뫠騩 
     Image Base.

  o  RVA  PE Header 騩 㫥 祭 㪠뢠  ,  ᮮ⢥-
     饥   ᯮ (   ஢ IMHO).
     
  o   ᯮ㥬 ࠭ (Image pages) ࠢ  ﬨ 
     ࠭ File Align.    ⠡     ࠢ-
       DWord (4 ) ࢭ.  ࠧ,  VA  RVA  -
       32-⭮ ࠭ [   ࠭ ࠧ饭 
     ᫮, 稭  0  䠩, ⠪  ⠩ ᬥ DWord' ;-)  
       ⠪  - ਬ. ].  ⠡    
      ࠢ   "த" ࠭,   ᪫祭 Debug
     Info.

 ⥯ 堫. . .

                                                                     PE Header
                                                                     ~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Signature Bytes        No   ઠ ⮣,   䠩  
                                         ᮡ⢥   PE   
                                           4550h,  -      
                                         'PE',0h,0h;  ᫥ -  
                                           --⠬      
                                         १ࢨ஢                 
Ĵ
 04h  Word   CPU Type               Yes    㪠뢠  ।-  
                                         ⥫ ;-) ⨯ ,   
                                          ஬ ⥫쭮 -    
                                           ணࠬ,  ।-  
                                          㢨 - ⫨筮    
                                          14Ch -> i386                 
Ĵ
 06h  Word   Num of Objects         No     㪠뢠  ᫮     
                                         ॠ 室  Object Table  
Ĵ
 08h  DWord  Time/Date Stamp        No   ᯮ  ࠭   
                                          ६ ᮧ/䨪樨  
                                         ஬                        
Ĵ
 0Ch  DWord  Pointer to COFF table  No   ⥫ 㪠⥫ -  
                                         騩 ⮭宦 ⫠-  
                                         筮 COFF ⠡  䠩,   
                                         ⫠ ଠ      
                                         ᥣ ᪠  㣮         
                 
 10h  DWord  COFF table size        No   - ᨬ  COFF ⠡  
Ĵ
 14h  Word   NT Header Size         No   ࠧ  PE 䠩 -   
                                         稭   Magic,     
                                           ணࠬ Hiew, ⠪   
                                         ࠧ, 騩 ࠧ  
                                         PE 䠩 ⠢ NT Header   
                                         Size + 18h                      
Ĵ
 16h  Word   Flags                  Yes  㪠뢠  ।祭     
                                         ணࠬ, ⭮ 祭  
                                         䫠 .                  
Ĵ
 18h  Word   Magic                  Yes   㪠뢠  ᭮      
                                         ।祭 ணࠬ        
                                         ᮫⭮ ᥬ    
Ĵ
 1Ah  Byte   Link Major             No   訩  ᨨ ᯮ짮-  
                                         襣  ᮧ   
                 
 1Bh  Byte   Link Minor             No   訩  ᨨ ᯮ짮-  
                                         襣  ᮧ   
Ĵ
 1Ch  DWord  Size of Code           No   ࠧ  ணࠬ -  
                                           䠩, KERNEL ᯮ   
                                          祭  䠪᪮   
                                         ⢥   㦠-  
                                          ணࠬ, ⠭ ⮣  
                                         祭 ᫨誮 쪨      
                                         ਢ  뤠 ᪮    
                                         ᮮ饭  墠⪥ ,    
                                                     
                 
 20h  DWord  Size of Init Data      No   ࠧ ᥪ樨 樠஢-  
                                          , 祢  ᯮ- 
                                           Windows'95  ᯮ-  
                                           NT, 祭 -  
                                         筮 ਢ          
                 
 24h  DWord  Size of UnInit Data    No   ࠧ ᥪ樨 樠-   
                                          , ᫮ ᪠,  
                                           3  ᯮ  
                                          ᮡ,        
                                          ⭮ ;-)  ,  
                                         ଠ ࠧࠡ뢠 ,     
                                         ॠ뢠  㣨. -   
                                           ॣ -    
                                           VirtualXXX 㭪樨       
Ĵ
 28h  DWord  Entry point RVA        No   , ⭮⥫쭮 Image Base  
                                          ஬ । ࠢ-   
                                           ᪥ ணࠬ     
                                           樠樨/-  
                                         襭 ⥪                
Ĵ
 2Ch  DWord  Base of Code           No   RVA ᥪ樨,  ᮤন    
                                         ணࠬ  (     
                                           ⢥ ;-) )     
                                           ᥬ   ᯮ-  
                                          ( ⠭ ୮)   
                 
 30h  DWord  Base of Data           No   RVA ᥪ樨 ᮤঠ饩 类     
                                         ,  ॠ 譨   
                                         㪠뢠   .data   .bss  
                                             㤠,     
                                         - ᯮ         
Ĵ
 34h  DWord  Image Base             No   㠫 砫      
                                         㧪 ணࠬ ( ࢮ  
                                         ).    ࠭  
                                         64  (易  ⥬ -   
                                          Windows'95)                
Ĵ
 38h  DWord  Object Align           No   ࠢ ணࠬ ᥪ-   
                                         権,   ⥯ 2     
                                          512  256 ⥫쭮,  
                                         ⠪  易  ⥬ -   
                                         .  ᯮ짮 㣨  
                                         祭 ணࠬ  -    
                                         .                          
Ĵ
 3Ch  DWord  File Align             No   䠪 ᯮ㥬  ࠢ-  
                                          ᥪ権  ணࠬ    
                                         䠩.  ⮢ 祭      
                                         㪠뢠  ࠭  -   
                                          ᥪ樨  0     
                                         ࠧ饭  䠩. 讥     
                                         祭 ਢ  樮-  
                                         쭮 ᯮ짮 ᪮  
                                         ࠭⢠, 쪮 㢥-  
                                         稢 ⭮,   ᭨-  
                                          ᪮ 㧪.   
                                          ⥯ 2     
                                         512  64 ⥫쭮. -   
                                         稥 祭 맮 訡     
                                         㧪 䠩.  ⠪ 㬠,    
                                          ࠧ 䠩 㪠     
                                         .                         
Ĵ
 40h  Word   OS Major               No   訩  ᨨ -   
                                          室  ᪠    
                                         ணࠬ                       
                 
 42h  Word   OS Minor               No   訩  ᨨ .    
Ĵ
 44h  Word   USER Major             No   짮⥫᪨  ᨨ,  
                                          짮⥫       
                                          ணࠬ        
                                         ᯮ                    
                 
 46h  Word   USER Minor             No   筮, 訩        
Ĵ
 48h  Word   SubSys Major           No   訩  ᨨ -  
                                         ,            
                                         ᯮ짠,   直   
                                         ᨩ 㦥 १ ࠩ           
                 
 4Ah  Word   SubSys Minor           No   筮, 訩        
Ĵ
 4Ch  DWord  Reserved               No     ᥬ ⠪       
Ĵ
 50h  DWord  Image Size             No   㠫 ࠧ       
                                         ᥣ 㦠 ࠧ,      
                                           , ⥭    
                                         Object Align                    
Ĵ
 54h  DWord  Header Size            No   騩 ࠧ  :   
                                         DOS Stub + PE Header +          
                                                         + Object Table  
Ĵ
 58h  DWord  File CheckSum          No   ஫쭠 㬬 ᥣ 䠩,  
                                              DOS'  -  
                                           ஫,      
                                          ⠢  0        
Ĵ
 5Ch  Word   SubSytem               Yes  樮 ⥬ 室-  
                                           ᪠  䠩   
Ĵ
 5Eh  Word   DLL Flags              Yes  㪠뢠  ᯥ樠 -   
                                         ॡ  㧪, 稭  
                                          NT 3.5 ५   ᯮ.  
Ĵ
 60h  DWord  Stack Reserve Size     No    ॡ㥬  ⥪      
                                         ਫ,  १ࢨ-   
                                         ,  뤥 ⮫쪮      
                                         Stack Commit Size ⮢, ᫥-  
                                          ࠭  -  
                                         .  ਫ -   
                                          ⮩ ࠭,  -    
                                          ⠭ 㯭,     
                                         ᫥ ࠭ - ࠭,  
                                          ⠪  ⨦       
                                         ࠭, ᫥ 祣 Windows'95  
                                         㡨 ணࠬ  ﬨ   
                                         ᪫祭    ⥪        
                 
 64h  DWord  Stack Commit Size      No   ꥬ  ⢮  ⥪  
                                          ᫥ 㧪       
Ĵ
 68h  DWord  Heap Reserve Size      No   ᨬ  ࠧ   
                                         쭮 娯                 
                 
 6Ch  DWord  Heap Comit Size        No   ⢮  㧪 娯      
Ĵ
 70h  DWord  Loader Flags           No   ? 稭  NT 3.5     
                                         ᯮ㥬, 祭      
                                         ᭮,   楫 易     
                                         প ⫠              
Ĵ
 74h  DWord  Num of RVA and Sizes   No   㪠뢠 ࠧ ᨢ        
                                         VA/Size  ᫥ ,   
                                           १ࢨ஢     
                                          騥 ७ ଠ  
                                             祭    
                                         ᥣ ࠢ 10h                
Ĵ
 78h  DWord  Export Table RVA       No    ⠡ ᯮ          
                 
 7Ch  DWord  Export Data Size       No   ࠧ ⠡ ᯮ         
Ĵ
 80h  DWord  Import Table RVA       No    ⠡            
                 
 84h  DWord  Import Data Size       No   ࠧ ⠡           
Ĵ
 88h  DWord  Resource Table RVA     No    ⠡ ᮢ          
                 
 8Ch  DWord  Resource Data Size     No   ࠧ ⠡ ᮢ         
Ĵ
 90h  DWord  Exception Table RVA    No    ⠡ ᪫祭        
                 
 94h  DWord  Exception Data Size    No   ࠧ ⠡ ᪫祭       
Ĵ
 98h  DWord  Security Table RVA     No   ?  ⠡ ᭮    
                 
 9Ch  DWord  Security Data Size     No   ? ࠧ ⠡ ᭮   
Ĵ
 A0h  DWord  Fix Up's Table RVA     No    ⠡ ஥          
                 
 A4h  DWord  Fix Up's Data Size     No   ࠧ ⠡ ஥         
Ĵ
 A8h  DWord  Debug Table RVA        No    ⠡ ⫠筮 .   
                 
 ACh  DWord  Debug Data Size        No   ࠧ ⠡ ⫠. .    
Ĵ
 B0h  DWord  Image Description RVA  No    ப ᠭ      
                 
 B4h  DWord  Description Data Size  No   ࠧ ப ᠭ    
Ĵ
 B8h  DWord  Machine Specific RVA   No   ?  ⠡ 祭 ᯥ- 
                                           ய      
                 
 BCh  DWord  Machnine Data Size     No   ? ࠧ ⠡ 祭 ᯥ-
                                           ய      
Ĵ
 C0h  DWord  TLS RVA                No   㪠⥫     
                                          楯祪                  
                 
 C4h  DWord  TLS Data Size          No   ࠧ   楯祪   
Ĵ
 C8h  DWord  Load Config RVA        No   ?                               
                 
 CCh  DWord  Load Config Data Size  No   ?                               
Ĵ
 D0h   08h   Reserved               No   ?                               
Ĵ
 D8h  DWord  IAT RVA                No   ?    㦥      
                                         ⮫쪮  ⨬ 䠩  
                                         ⥬ Windows'95,          
                                         SNDREC32, CDPLAYER, MPLAYER     
                                          㪠뢠  ⠡        
                                         ᮢ   䠩 (-  
                                           ) ᠫ     
                                          ணࠬ  祫     
                                         祣  ⥫. . .              
                                         ᯮ  NT,  Windows'95 
                                           ᥬ                
                 
 DCh  DWord  IAT Data Size          No   ? ࠧ ᠭ         
Ĵ
 E0h   08h   Reserved               No   ?                               
Ĵ
 E8h   08h   Reserved               No   ?                               
Ĵ
 F0h   08h   Reserved               No   ?                               
͵
 F8h  Total Structure size           No   騩 ࠧ           
;

CPU Type  ᫥騥 祭:
~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0000h -    
  o  014Ch - i386
  o  014Dh - i486
  o  014Eh - i586
  o  0162h - MIPS Mark I (R2000, R3000)
  o  0163h - MIPS Mark II (R6000)
  o  0166h - MIPS Mark III (R4000)
     
Flags  ᫥騥 ⮢ 祭:
~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0000h -  ணࠬ
  o  0001h - 䠩  ᮤন ६饭  ⠡ ६頥 ⮢
  o  0002h - ࠧ  䠩  ᪠
     ᫨    ⠭,   筮 㪠뢠  訡 -
       ⠯ ,    ,    ६⠫쭮
     ⫨ , ᫥⥫쭮,    饭. [६⠫쭠
      - 筠     ⪠ ணࠬ, 
      ⠫쭠 ४ ஥,  ࠧ㬥  -
     ᪠ 祭 㤭, ᪠ ⠪ - !]
  o  0200h - 㧨 䨪஢
     뢠  ,  ணࠬ  㧨 ⮫쪮   ᠭ-
       Image Base, ᫨  ,  ⠪ 䠩   
     ᪠.
  o  2000h -  ⥪

Magic  ᫥騥 祭:
~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0107h - ணࠬ  믮   (  ?)
  o  010Bh - ଠ쭠 ணࠬ  
     
SubSystem  ᫥騥 祭:
~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0000h -    
  o  0001h - Native, 諨    ⠪- ,   㦥
  o  0002h - Windows GUI, .. 筠
  o  0003h - Windows Character (᮫쭮 ਫ)
  o  0005h - OS/2 Character
  o  0007h - Posix Character (ଠ PE  客᪮ ।࠭,  . . .)

DLL Flags  ᫥騥 ⮢ 祭:
~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0001h - 樠 ⥪  
  o  0002h - 襭 ⥪  
  o  0004h - 樠 ⥪   (楯)
  o  0008h - 襭 ⥪   (楯)
 稥  १ࢨ஢  ⥫쭮  ⠭  0 祭, 
 ⮣    ;-)

[3]  ꥪ⮢ (ᥪ権) 䠩 (Object Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ᫮ 室  ⠡ ꥪ⮢ (ᥪ権) ।  Num  of  Objects
 PE Header. 室  ⠡ ꥪ⮢  㬥  稭    1.  
⠡ ᯮ ।⢥  PE Header.  ᫥⥫쭮  ᥪ権
     롨ࠥ ஬. 㠫  ꥪ⠬  
 ᢮ ஬   饬  浪      묨  Object
Align   PE Header. ⮨ ,  ⥪ ॠ  稪
Windows'95  ࠧ砥 浪 ꥪ⮢  (ᥪ権)    ⠡,  ⮬  
ᬥ  ᯮ      ந쭮   浪.      ᥪ   (ꥪ)
ᯮ , ஥     祬    뢠,      
ந,  -    ᮤঠ  ᥪ樨        
ࠢ ᮢ.

                                                                   Object Entry
                                                                   ~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h   08h   Object Name            Yes   ꥪ, ⮪    
                                         ﬨ, ᫨  ꥪ   
                                          8 ᨬ,  -  
                                         ⥫쭮 0 .  PE    
                                            ⮬ 䠪.   
                                          - 㪠 䮭ୠ   
                                           祬  뢠.         
Ĵ
 08h  DWord  Virtual Size           No   㠫 ࠧ ᥪ樨,      
                                          ⮫쪮  㤥 - 
                                           ᥪ. ᫨ Virtual 
                                         Size ॢ蠥 Physical Size,   
                                          ࠧ  ﬨ,  
                                         ⠪ । ᥪ樨 -  
                                         樠஢  (Physical
                                         Size = 0)                       
                 
 0Ch  DWord  Section RVA            No   ࠧ饭 ᥪ樨  ,     
                                         㠫   ⭮⥫-
                                          Image Base.     
                                         ᥪ樨 ࠢ  ࠭     
                                         Object Align (⥯ 2  512  
                                          256 ⥫쭮,  㬮-  
                                         砭 64)  ᥪ樨 㯠   
                                            , 祬,  
                                            ᮡ.         
Ĵ
 10h  DWord  Physical Size          No   ࠧ ᥪ樨 ( 樠- 
                                          )  䠩, ⭮   
                                          File Align   PE  
                                         Header,      
                                         ࠢ Virtual Size.       
                                         ⨬    - 
                                          १⮢ ;-) 稪 
                                           嫮  ᥪ     
                                         ⢥                   
                 
 14h  DWord  Physical Offset        No   䨧᪮ ᬥ饭 ⭮⥫- 
                                          砫 EXE 䠩, ஢  
                                          ࠭ File Align  -  
                                          PE Header. 饭     
                                         ᯮ 稪     
                                         seek 祭.                  
Ĵ
 18h   0Ch   Reserved               No   १ࢨ஢  OBJ 䠩,  
                                          譨 ᫠      
Ĵ
 28h  DWord  Object Flags           Yes  ⮢ 䫠 ᥪ樨, .   
͵
 2Ch  Total Structure size           No   騩 ࠧ ⥫ ᥪ樨   
;

Object Name ᪮쪮 ਬ஢  :
~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  .text     -   ᠥ 믮 
  CODE      -  ૠ    
  .icode    - 室   ᨩ TLINK32
  .data     -    
  DATA      -  ૠ 
  .bss      - 樠஢  (ࠢ 0  䠩)
  .CRT      - 樠஢  C/C++  ૠ
  .rsrc     - 
  .idata    - ᥪ 
  .edata    - ᥪ ᯮ
  .reloc    - ⠡ ஥
  .tls      -     Windows ᪠ 楯窨
  .rdata    - ⫠筠 ଠ

  _FREQASM  - ᬮ  KERNEL32,  㬠,  ⠪ ⭮
  PROTECTED -    ᯮ᪮ ࢥ,  ⠪
  . . . . . -  ⠪ 

    -    ᥪ樨      ,    -  
। 祣 ;-)   ࠧ ।।!  譨    ᮤঠ
 ⢥ ᥪ,    ⮫ .   㤥 ࠡ!

Object Flags  ᫥騥 祭:
~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
  o  00000004h - ᯮ    16 묨 ᬥ饭ﬨ
  o  00000020h - ᥪ 
  o  00000040h - ᥪ 樠஢ 
  o  00000080h - ᥪ 樠஢ 
  o  00000200h - ਨ   㣮 ⨯ ଠ樨
  o  00000400h - ૥ ᥪ
  o  00000800h -  㤥   ࠧ ணࠬ
  o  00001000h - 騥 
  o  00500000h - ࠢ  㬮砭, ᫨  㪠 
  o  02000000h -   㦥  
  o  04000000h -  
  o  08000000h -  ࣠ ࠭筮 ८ࠧ
  o  10000000h - ࠧ塞
  o  20000000h - 믮
  o  40000000h -  
  o  80000000h -  
 稥 祭 १ࢨ஢    ⠭  0. 設⢮
祭  Windows'95  ᯮ, 猪   ᯮ   NT.

[4] ࠭ ࠧ ᥪ権 (Image Pages)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ࠧ ᮤন   樠஢        ꥪ⮢
(ᥪ権).  祭  樮஢    砫  ࠭     ꥪ
㪠  ⠡ ꥪ⮢ (Object Table)  ࠢ  ࠭ File  Align  
 PE Header. ꥪ ஢  浪    RVA    ࠢ  
Object Align,   ᯮ    ⨬樨  㧪,      
ࠢ  ᮡ, 稪 Windows'95   ᯮ.
    ⬥   ᮡ, ᫨  -  㪠  RVA,    
ࠧ㬥    ᯮ     ᪠஢   ⠡   ᥪ権   
।  ॠ쭮      䠩  !!!  ணࠬ  ⨯  ૠ᪮
TDUMP, PEDUMP ( ४) ⮣     ᢮ GPF   
⪥  ࠡ  ⠪  䠩      RVA  ᪮쪮   ⫨砥   
।,  ⥬      Windows'95    䠩  ४᭮   㧨   
ࠡ뢠.      訡!      ࠧ    䠩    
ன ᮧ ஬ Borland C++ (易   ⮬,    㤥
㦤 ,      ).
       㦭  㪠      ,    ᬮ७
ࠬ Bizatch, 祬  ⮬ ⠪- .

[5] ᯮ
~~~~~~~~~~~
筮 ᥪ ᯮ ਡ⥫쭮 룫廊 ᫥騬 ࠧ:
                                                          Typical Export Layout
                                                          ~~~~~~~~~~~~~~~~~~~~~
͸
  ᮡ⢥ ᯮ                      Export Directory Table    
͵
      ᭠ ⠡                              Export Address Table    
Ĵ
  㪠⥫                       Export Name Table Pointers 
Ĵ
       न                             Export Ordinal Table    
Ĵ
       ᠬ                               Export Name Table     


 ᪠ 筮,    ᪠,  ⠪    ,        ᥩ
ᬮਬ  ᯮ  堭 ᯮ, ᥩ ,  ,      
 ᥪ権, 襮ᠭ         ଠ  ᯮ
䠩 ( ⮢).  ᪫祭 Export  Directory  Table    ⠫쭮
ࠬ     寧.


[5.1]  ᯮ (Export Directory Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ଠ ᯮ 稭  Export Directory Table,    뢠
ॡ㥬 ᯮ  ଠ.  Export  Directory  Table  ᮤন  
ଠ ᯮ㥬   ࠧ離  ࠨ  뫮    譨  窨
室  ணࠬ.
                                                         Export Directory Table
                                                         ~~~~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Flags                  No   १ࢨ஢  饥 =0   
Ĵ
 04h  DWord  Time/Date Stamp        No   ६   ᮧ ᯮ-  
                                                                
Ĵ
 08h  Word   Major Version          No     , , 訩    
                                          ᨨ ⠡ ᯮ   
                                          , ⠪  ᯮ     
Ĵ                 
 0Ah  Word   Minor Version          No   筮, 訩             
Ĵ
 0Ch  DWord  Name RVA               No   RVA ப 㪠뢠饩     
                                         襩 ⥪                
Ĵ
 10h  DWord  Ordinal Base           No   砫  ᯮ,    
                                         㭪権 襩 ⥪, 筮
                                         ⠭  1,   䠪     
Ĵ
 14h  DWord  Num of Functions       No   ⢮ 㭪権 ᯮ-  
                                          訬 㫥,     
                                         ᫮ ⮢ ᨢ        
                                         Address Table .           
Ĵ
 18h  DWord  Num of Name Pointers   No   ᫮ 㪠⥫  , -
                                          ࠢ  㭪権,    
                                          ⠪ ᫨    㭪樨  
                                         ᯮ㥬 ⮫쪮   
Ĵ
 1Ch  DWord  Address Table RVA      Yes  㪠⥫  ⠡ ᮢ    
                                         (RVA) ᯮ                  
Ĵ
 20h  DWord  Name Pointers RVA      Yes  㪠⥫  ⠡ 㪠⥫ 
                                           ᯮ               
Ĵ                 
 24h  DWord  Ordinal Table RVA      Yes  㪠⥫  ⠡ न  
                                         ᯮ,  ᨢ       
                                         ᠬ ࠫ Name        
                                         Pointers, ⠬    
                                         ᫮                           
͵
 28h  Total Structure size           No   騩 ࠧ ⠡窨 ᯮ  
;

    ࠡ⪨ ᮢ  뢠 稪 ⥬ :
-   :   ᨢ ,    न, न
  ४    ⨬ ᮬ 뢠  㭪樨
    ᨢ Address Table
-   न: न ४    ,  ᠭ 

    ⬥,    ⠡  ᯮ    ᮤঠ  ய᪨,  
⮡ࠦ 㫥묨 祭ﬨ ᮢ ᯮ. ஢    न
祭 ⥫쭮   ࠧ  Windows'95 न 㭪権    
ࠧ,   㦥  NT  .

[5.2]  ᮢ ᯮ (Address Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ᮤন   ᯮ㥬  㭪権  (  窨
室) 㥬     ..    ଠ  DWord  RVA  (  4    
).  㯠   ᯮ न  㭪樨    ४樥  
 न (Ordinal Base).

[5.3]  㪠⥫   (Name Table Pointers)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       ᮤন  㪠⥫      ᯮ㥬   㭪権,
㪠⥫ ஢    ᪮  浪    ᯥ祭  
୮ ᪠.  㪠⥫    4  .    㭪権  筮
  ᥪ樨 ᯮ,    ᪠ 筮 ;-)      
㤠.  ࠧ , ᥪ樨  -    䥬୮,  ᯥ稢饥  㯠
ணࠬ  䠩   ⪮ ,   .

[5.4]  न (Ordinal Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     ᮢ⭮  Name Table Pointers  ନ  2  ࠫ
ᨢ, ࠧ  祭    㯠  ஢    த
   (᫮,  ᫮,   ᫮  ).  
ᨢ ᮤন न ᯮ,   饬 砥  ᠬ  
Address Table ᯮ (  ⮬    Ordinal  Base).  ⠬  
ᨢ  ᫮ (2 ).

[5.5]   ᯮ (Export Name Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ⠡ ᮤন 易⥫ (  Microsoft,  祣  ᥡ  ;-)
 ᯮ㥬 㭪権.  ᨢ ᯮ  ᮢ⭮    Name
Table  Pointers    Ordinal  Table    ᯥ祭   뢠   稪
/ᯮ  . 堭  뢠  .      
ᮡ ASCIZ ப   ᯮ㥬 㭪樨.   ,    
  䠩      㣮  ᫥⥫쭮,    ⠪    ஥
設⢮ 䠩.  ⬥,   ᯮ ⢨⥫  ॣ.
   ⬥⨬  ᮡ  稪  -    뢠,  ᫨     㭪樨
室  ᥪ樨 ᯮ,     ᠬ      㪠    
ப ॠ  㣮  ⥪  ᯮ饩    㭪  (
㪠 ⥪  ᠬ 㭪樨),  뢠 ।  ᯮ  (᫨
  ४,      ஢).

[6] 
~~~~~~~~~~
     室    ᠬ  ᭮  ࠧ    䠩      PE
ᯮ  䠩.    ࠢ    묨  16  묨  ਫﬨ  
⥫쭮 ⨫ -  ਬ ⥬  ⮬,      ⨬  맢  
㤠,  ⥬  㦭  襩 ணࠬ ।⠢    室
( 襩 FLAT  㠫쭮 設). .   㦥  ᯮ
 ࠧ.  Borland  ந  ᠬ⥫쭮    ᥪ樨    (筥  )
室 
   SomeThunkGate: Jmp D,[0XXXXXXXXh]
  뫪  ணࠬ ଫ:
   Call SomeThunkGate
  ⮬    ࣠樨        騪  (,
Borland ᯮ  OMF ଠ). த⥫ ⮤ 諨  㣨  ⥬.
室 ᮤঠ   ⥪          ⥪.
          ணࠬ,  祬        ன
ᮡ:  ᥪ権 ᮤঠ騥   ᥡ    '$'    ꥤ  
祭 ⠢襩   (ᥪ樨  㯮冷稢  ।  ᫨ﭨ  
⠢襩  ).    ⠥      祣-  த  .idata$1
.idata$2  .idata$3  ⠢    㤮ਬ  ᥪ  .idata    
, Microsoft  ᢮ ணࠬ  ࣠ 맮 譨  㭪権
᪮쪮    ࠧ:     Near   맮   室   ᯮ
।⢥ ॡ㥬 , ਬ୮ ⠪
   Call DWord Ptr [SomeServiceAddressVariable]
ᮧ訥 ଠ  ᮧ 㤮  ;-)

[6.1] ⠫  (Import Directory Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ଠ  稭  Import Directory  Table,    뢠
⠫ ଠ   .  Import  Directory  Table  ᮤন  
ଠ ᯮ㥬  ࠧ襭 뫮    窨  室    ࠧ
⥪.   ⮨  ⤥ 室,     
   㥬  ⥪.  ᫥  室,  㪠뢠騩    
⠡   ( ﬨ).
    "ଠ" 䠩  ଠ   ।   Import
Directory Table ( 䨧᪨   ࠧ    ⠡    㣮).
 ⮨ ਬ୮ ⠪:
                                                          Typical Import Layout
                                                          ~~~~~~~~~~~~~~~~~~~~~
͸
    ⠫                                  Import Directory Table  
͵
  뫮                                   LookUp Table       
Ĵ
                                            Hint-Name Table      
Ĵ
  ᮢ                              Import Address Table   


 ਡ⥫쭠 ᫥⥫쭮 ᯮ   䠩  ࠧ  ⥩
ᥪ樨 , ᮧ 騬  騪.    ॠ  䠩
  ࠭祭  冷 ᫥  ⪮  ᥪ樨  ,    
稪  Windows'95      ᯮ  ᫥.  ଠ     室
⠫  ਢ  ⠡  .
                                                         Import Directory Entry
                                                         ~~~~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Import LookUp          Yes  ন 뫪  ⠡ RVA 
                                         㪠뢠  ᮮ⢥騥  
                                         Hint-Name's  ।⢥ 
                                         न 㥬 室     
Ĵ
 04h  DWord  Time/Date Stamp        No   ⬥⪠  ६ ᮧ,     
                                          ᮤন 0 (-)         
Ĵ
 08h  DWord  Forward Chain          No   ? 易   -  
                                          ᯮ  㣨 -  
                                         ⥪. 筮 ࠢ 0FFFFFFFFh   
Ĵ
 0Ch  DWord  Name RVA               No   뫪  ⥪  ன  
                                          室  맮   
                                         ।⠢   ASCIZ.      
Ĵ
 10h  DWord  Addres Table RVA       Yes  뫪  ⠡ ᮢ      
                                         ,  ⥬   
                                          뢠                  
͵
 14h  Total Structure size           No   騩 ࠧ ⠡窨    
;

[6.2]  ᬮ  (Import LookUp Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     ࢨᮢ  ⥪  ᮤঠ    Hint-Name's  Table.     ଠ
쭮 :
                                                                Hint-Name Entry
                                                                ~~~~~~~~~~~~~~~
͸
 Word    ந  Byte   ப 뢠 㫥 ⮬,   
                     室   ࠢ-  
 Hint   ASCIZ Service Name   PAD      ⭮ ࠭   0  


     ࢨᮢ   뫠  RVA    ⠡  Import  LookUp.    砥
  न 訩  祭  ⠡ Import  LookUp  ⠭
  .    ⠡  室    㫥  .      ⪥
뢠     ⥬  稪  ᯮ  砫  祭  Hint
(㪮祭 䨪 窨 室)   ⮫쪮    㤠筮  ⪥  
ᯮ짮 ந   ᢮  ⥬  ⠡    ॡ㥬  窨
室.  ࢨ ⢨⥫쭮  ॣ.  ⥪ - .

[6.3]  ᮢ  (Import Address Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ⠡ ਭ   ᥡ  ଠ  ᫥  뢠  稪
    譨  ⥪,    蠥  㫥  ⮬.   祭
 䠪⮬  ,    ணࠬ  㦥 .  
ࠢ,  襩 ,   ணࠬ  ᠬ  Windows'95.    䠪
⠢  ।,    稪       믮   ⮬⥫쭮
楤 ன   .    㤥  室    㧨
䠩    । 㤠 ࠢ. .  .    ࠢ  筮    COM
ଠ!
   , ,  墠 㭪樨  ⥪         ⮩
⠡  -  쭮  ⮩    騩  ⮤  墠   ࠢ   
⤥쭮 .     襪    ,    ⠡  (  
 㣨 ⠡ )  室  ᢮ ஬  ,    
Import Directory Table   , ७  ॡ㥬    ⠬
⠢.  ४  쭮,    ஡  騥    ⮬
쬠 ⥫    뢠.


[7] 쭠   楯祪 (Thread Local Storage)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   쭠   楯祪,  ᯥ樠 殮    .
 楯窠  ᮡ⢥      ᢮  ᮧ.    ਬୠ
  :
                                                             Typical TLS Layout
                                                             ~~~~~~~~~~~~~~~~~~
͸
  ࠧ 楯祪                         TLS Directory Table       
͵
       楯祪                                   TLS Data             
Ĵ
    ६                             Index Variables         
Ĵ
   맮                          CallBack Addresses        


[7.1]  ࠧ 楯祪 (TLS Directory table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   TLS Directory Table ᮤন  ଠ,   ᯮ  
ᠭ ⠫쭮  TLS.   ᫥騩 ଠ:
                                                            TLS Directory Table
                                                            ~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Start Data Block VA    No   㠫  砫   
                                          楯窨                  
Ĵ
 04h  DWord  End Data Block VA      No   㠫      
                                          楯窨                  
Ĵ
 08h  DWord  Index VA               No   㠫  ᭮ - 
                                         ६, ᯮ㥬  - 
                                         㯠  쭮    
                                         楯窨                         
Ĵ
 0Ch  DWord  CallBack Table VA      Yes  㠫  ⠡ -
                                          맮                     
͵
 10h  Total Structure size           No   騩 ࠧ ⠡窨 TLS       
;

[7.2]   맮 楯窨 (TLS CallBack Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     맮 -  ᨢ  㠫  ᮢ  㭪権,  
 맢 稪 ᫥ ᮧ 楯窨 ()  ᫥   襭.
᫥ 室  㫥 祭  㪠력   ⠡.

[8] 
~~~~~~~~~~~
    ।⠢ ᮡ  ஢  筮-஢  ॢ.
 ஥஢    ᮤঠ    2^31  ஢,  ,
ॠ쭮 ᯮ ⮫쪮 3: ᠬ 孨  Type,  ⥬  Name,    ⥬
Language (⨯, , ). 筮 ।⠢ ᭮ ⪠  䠩:
                                                       Typical Resources Layout
                                                       ~~~~~~~~~~~~~~~~~~~~~~~~
͸
     ⠫  ᮢ                       Resources Directory Table      
͵
       ᮢ                              Resources Data           
;

 ⠫ ᮢ ᬮਬ .

[8.1] ⠫ ᮢ (Resource Directory Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                                       Resource Directory Table
                                                       ~~~~~~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Flags                  No     ᯮ,     
                                          襭  0               
Ĵ
 04h  DWord  Time/Date Stamp        No     ६ 祭 - 
                                         ᮢ  ᭮    
Ĵ
 08h  Word   Major Version          No   ,     -  
                                         ᨨ, 訩             
                 
 0Ah  Word   Minor Version          No   --//--  訩                
Ĵ
 0Ch  Word   Name Entry             No   ⢮ 室  ⠡ 
                                         ᮢ, ⠡ ᯮ 
                                          ᠬ 砫 ᨢ 室   
                                          ᮤন ப       
                                         樨㥬  ᠬ       
Ĵ
 0Eh  Word   ID_Num Entry           No   ⢮ 32-⮢ - 
                                         ஢ ᮢ                
͵
 10h  Total Structure size           No    ⠫ ᮢ        
;
 ⠫  ᮢ  ࠧ  ᫥  ᨢ  ६  ,  ᮤঠ騩
 室. Name Entry  ᮤন  ᫮    室    
(易   室).  ⢨⥫  ॣ   ᯮ  
浪 ⠭. ID_Num Entry । ᫮ 室      ⢥
 32-⮢ 䨪.  室 ⠪  ஢   ⠭.
       ᠬ      
䨪,   ⤥쭮 ⮣   ⮫쪮        ᪠
ন,  !   ᮣ    ᨭ⠪ᮬ  .RC    .RES  䠩.
 室  ⠡ ᮢ  ᫥騩 ଠ:

                                                            Resource Entry Item
                                                            ~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Name RVA or Res ID     No    ᮤন  䨪-  
                                          ,  㪠⥫   
                                            ⠡  ᮢ 
Ĵ
 04h  DWord  Data Entry RVA or      No   뢠   ,   
             SubDirectory RVA               ⠡ 室      
                                         ᮢ, 31- 襭     
                                          0 㪠뢠  ,      
                                         뫪         
͵
 08h  Total Structure size           No    ᭮ 室         
;

ப ⠫ ᮢ  ᫥騩 ଠ:
                                                Resource Directory String Entry
                                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ŀ
 Field Name:  Length  Unicode String   ப   ⭠ 2  
Ĵ ( 祢)  ⠪ ப  
 Field Type:   Word    unpredictable  ꥪ  ࠭          

   ப ⠫  ᮢ  ࠧ  ᫥  ᫥  Resource  Directory
Entry      ࢮ  Resource  Data  Item,        ⭮
ࠧ ଠ.  㭪   ᫥騩 ଠ:
                                                            Resource Data Entry
                                                            ~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Data RVA               No   ⥫  ॠ쭮 ᯮ-   
                                           ⭮⥫쭮      
                                         Image Base                      
Ĵ
 04h  DWord  Size                   No              
Ĵ
 08h  DWord  CodePage               No    ࠭                
Ĵ
 0Ch  DWord  Reserved               No    ᯮ  ⠭-  
                                           0                        
͵
 10h  Total Structure size           No    㪠⥫   
;
 室  ⠡ ᮢ 뢠 㧥  ॢ  ᮢ.    ᮤন
 ⭮⥫쭮 Image Base,    Size  㪠뢠    ᫮    
室  ⮬ ,   ࠭  ᯮ    ஢
祢 祭   .  筮    ਫ  ᮤঠ
祭 ᮮ⢥饥 Unicode  ⠡. (, . 筮?)

[8.2] ਬ  ࠧ饭 ᮢ
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ਢ ਬ ਫ ஥   ᯮ짮  ᫥騥    
⢥ ᮢ:
                          
 ~~~~~~~~    ~~~~~~~~       ~        ~~~~~~~~
 00000001    00000001       0        00010001
 00000001    00000001       1        10010001
 00000001    00000002       0        00010002
 00000001    00000003       0        00010003
 00000002    00000001       0        00020001
 00000002    00000002       0        00020002
 00000002    00000003       0        00020003
 00000002    00000004       0        00020004
 00000009    00000001       0        00090001
 00000009    00000009       0        00090009
 00000009    00000009       1        10090009
 00000009    00000009       2        20090009

  ⠫  PE 䠩 㤥 룫拉 ᫥騬 ࠧ:
饭            
~~~~~ ~~~~~~~~ ~~~~~~~~ ~~~~~~~~ ~~~~~~~~
0000: 00000000 00000000 00000000 00030000  (3 室  ⮬ ⠫)
0010: 00000001 80000028
    ( #1, ⠫  ᬥ饭 0x28)
0018: 00000002 80000050     ( #2, ⠫  ᬥ饭 0x50)
0020: 00000009 80000080     ( #9, ⠫  ᬥ饭 0x80)
0028: 00000000 00000000 00000000 00030000  (3 室  ⮬ ⠫)
0038: 00000001 800000A0     ( #1, ⠫  ᬥ饭 0xA0)
0040: 00000002 00000108     ( #2, ਯ   ᬥ饭 0x108)
0048: 00000003 00000118     ( #3, ਯ   ᬥ饭 0x118)
0050: 00000000 00000000 0000000000040000  (4 室  ⮬ ⠫)
0060: 00000001 00000128     ( #1, ਯ   ᬥ饭 0x128)
0068: 00000002 00000138     ( #2, ਯ   ᬥ饭 0x138)
0070: 00000003 00000148     ( #3, ਯ   ᬥ饭 0x148)
0078: 00000004 00000158     ( #4, ਯ   ᬥ饭 0x158)
0080: 00000000 00000000 00000000 00020000  (2 室  ⮬ ⠫)
0090: 00000001 00000168     ( #1, ਯ   ᬥ饭 0x168)
0098: 00000009 800000C0     ( #9, ⠫  ᬥ饭 0xC0)
00A0: 00000000 00000000 00000000 00020000  (2 室  ⮬ ⠫)
00B0: 00000000 000000E8     ( 0, ਯ   ᬥ饭 0xE8
00B8: 00000001 000000F8     ( 1, ਯ   ᬥ饭 0xF8
00C0: 00000000 00000000 00000000 00030000  (3 室  ⮬ ⠫)
00D0: 00000001 00000178     ( 0, ਯ   ᬥ饭 0x178
00D8: 00000001 00000188     ( 1, ਯ   ᬥ饭 0x188
00E0: 00000001 00000198     ( 2, ਯ   ᬥ饭 0x198

00E8: 000001A8  ( ᬥ饭 0x1A8,   #1,  #1,  #0
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
00F8: 000001AC  ( ᬥ饭 0x1AC,   #1,  #1,  #1
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0108: 000001B0  ( ᬥ饭 0x1B0,   #1,  #2,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0118: 000001B4  ( ᬥ饭 0x1B4,   #1,  #3,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0128: 000001B8  ( ᬥ饭 0x1B8,   #2,  #1,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0138: 000001BC  ( ᬥ饭 0x1BC,   #2,  #2,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢) 0
148:  000001C0  ( ᬥ饭 0x1C0,   #2,  #3,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0158: 000001C4  ( ᬥ饭 0x1C4,   #2,  #4,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0168: 000001C8  ( ᬥ饭 0x1C8,   #9,  #1,
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0178: 000001CC  ( ᬥ饭 0x1CC,   #9,  #9,  #0
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0188: 000001D0  ( ᬥ饭 0x1D0,   #9,  #9,  #1
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)
0198: 000001D4  ( ᬥ饭 0x1D4,   #9,  #9,  #2
      00000004  (4  )
      00000000  ( ࠭)
      00000000  (१ࢨ஢)

    ᮢ  ⠪묨:
01A8:          00010001
01AC:          10010001
01B0:          00010002
01B4:          00010003
01B8:          00020001
01BC:          00020002
01C0:          00020003
01C4:          00020004
01C8:          00090001
01CC:          00090009
01D0:          10090009
01D4:          20090009

[9]  ஥ ᮢ (FixUp Table)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ஥ ᮢ ᮤন    䨪஢ ᮢ  
ࠧ ணࠬ.    PE  䠩      FixUp's  Data  Size
ᮤন 騩 ࠧ    ⠡.   ⠡  ஥  ᮢ
ࠧ      ஥  (    ।⠢  ன     4-
⮢ ࠭).
   易  ஬       㦤      ⥫쭮   ன
稪   ,   稪    ﭨ  㧨  ணࠬ  
, 㪠   .  믮  ⮣  ᫮  稪
਩ ४஢   ணࠬ.   ⮬  FLAT      
㠫樨 ᭮ ࠭⢠      稪  
 ਩      ,  ᪫祭      ⥪,
   ਢ뢠   䨪஢   (Borland
ਬ),  砩 䫨   ⥪.

[9.1]  ஥ ६饭 (FixUp Block)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ஥  ᫥騩 쭮 ⮩ ଠ:
                                                                    FixUp Block
                                                                    ~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Page RVA               No   ⥫  ࠭ ਬ-  
                                          ஥ ६饭        
Ĵ
 04h  DWord  Block Size             No     ஥ ( -  
                                         )                         
Ĵ
 08h  Word   TypeOffset Record      Yes  ᨢ ᥩ ஥,      
                                         ६ ⢮           
͵
 ...  Total Structure size           No   ⠡  ६ ࠧ 
;

      ன  室  ᫨  -祭.  32-⭮
  ࠧ    㧪  ⢨⥫쭮. ᫨  ࠧ
ணࠬ 㦥  ॡ㥬 ,   ࠢ     ன
ந  .   ஥   稭    DWord  ࠭
( ஢),  ࠢ   짮 ﬨ.
    ன 室       㬬  Page  RVA  
Image Base 㦥 ணࠬ. TypeOffset । ᫥騬 ࠧ:
                                                               TypeOffset Entry
                                                               ~~~~~~~~~~~~~~~~
Ŀ
 15 ... 12  11 ... 0   ᫮, Type 㪠뢠  ⨯ ன,  Offset
Ĵ   ᬥ饭  4-⮢  ਬ- 
   Type      Offset    ஥.                                      


 Type  ᫥騥 祭:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0h -  ᮫    ந  ॡ.
  o  1h -  訥 16 ⮢   16 ⮢  室饬 
          ᬥ饭 Offset. 16 ⮢  ।⠢ 訥  32--
           ᫮.
  o  2h -  訥 16 ⮢   ᬥ饭 Offset. 16-⮢ 
          ।⠢   32-⮢ ᫮.   -
          ன  ⮫쪮  RISC 設  Object Align 
            㬮砭 64.
  o  3h - ਡ 32-⮢   32-⮢ 祭.
  o  4h - ன ॡ  32-⮢ 祭. 訥 16-
             Offset,  訥  ᫥饬  TypeOffset
            ꥤ   ६, ⥬ 
          32-⮢   DWord 8000h. 訥 16  稢襣 -
          祭 ࠭   Offset  16-⮢ .
  o  5h - ? - 易  MIPS.
 ॠ쭮   ⠫ ⮫쪮  ⨯ 0  3,  ⠫   ⥫
祢  ⮫ , ᭮      ᯥਬ⮢.    稥
⨯ ६饭 १ࢨ஢ Microsoft.

[10] ⫠筠 ଠ (Debug Information)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ⫠筠 ଠ ࠧ頥  ᯮ짮 ⫠稪    ᮧ
 । ଠ ஬.  ⢥  ।    -  
⫠筮 ଠ樨 (Debug Directory  Table).  PE  䠩  ⠪  ন
COFF ଠ  ⫠稪 (ᮮ⢥騥 뫪   ).  
㤥  祭 ᮪饭 饥 ᠭ ⫠筮 ଠ樨  PE 䠩.

[10.1] ⫠ ⠫ (Debug Directory)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ⠫ ⫠ ࠭ 뫪   ⫠  ଠ,  ଠ
 ᫥騩:
                                                          Debug Directory Entry
                                                          ~~~~~~~~~~~~~~~~~~~~~
͸
      Size                         Com-                                  
Base   or        Name Of field     ments       Brief description         
      Type                                                               
͵
 00h  DWord  Debug Flags            No    ᯮ  ⠭  
                                         㫥 祭                
Ĵ
 04h  DWord  Time/Date Stamp        No     ६ ᮧ ⫠-  
                                          ଠ樨                  
Ĵ
 08h  Word   Major Version          No   訩  ᨨ ⫠-   
                                          ଠ樨                  
                 
 0Ah  Word   Minor Version          No   訩  ᨨ --//--     
Ĵ
 0Ch  DWord  Debug Type             Yes   ଠ樨  ⫠稪    
Ĵ
 10h  DWord  Data Size              No             
                                         ⫠  ࠧ    
Ĵ
 14h  DWord  Data RVA               No    ᯮ ⫠   
                                                               
Ĵ
 18h  DWord  Data Seek              No   饭  ⫠    
                                         䠩                           
͵
 1Ch  Total Structure size           No     ⠫ ⫠
;

 ⫠筮 ଠ樨:
~~~~~~~~~~~~~~~~~~~~~~~~~~
  o  0001h - COFF ⠡ ᨬ.
  o  0001h - CodeView  ᨬ.
  o  0001h - FPO ⠡ ᨬ.

᫨   ணࠬ  ᮤন      ⨯  ⫠筮  ଠ樨,  
᫥   ⠫ ⫠ 㤥 ᫥ ࠧ  ࢮ    
㫥 祭.

[11]   ᬮ७   ᠭ
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ᬮ  ⥫쭮 饭 ଠ 䠩 PE  ࠢ   묨
NE 䠩,       ७    ⮣,  ⮡        쪮
㪮⢮.  ६  ᠭ  㤥      ४஢.  
  ६  ⮬ ⠫ ᫥騥 :
  -  ⠫쭮 ᬮ७ ⫠筮 ଠ樨
  -     ᠭ  
  -    ᬮ७ ॠ樨 ⥬  㧪 䠩
  -  - . . .

[12] P.S.
~~~~~~~~~
    쭥襣      筥  ᠭ,    ⠪    ࠭
筮⥩    ਧ⥫      ⨢  ਨ  
. ० 祬  㣠⥫⢠, ४ ᬮ  .1 
  ᫥騬 ࠧ:

                     FidoNet: 2:461/133.69 * Hard Wisdom
                 
                              Seek And Destroy!

