{"id":50,"date":"2019-11-19T22:10:16","date_gmt":"2019-11-19T14:10:16","guid":{"rendered":"http:\/\/blog.73007300.xyz\/?p=50"},"modified":"2019-12-24T20:14:42","modified_gmt":"2019-12-24T12:14:42","slug":"%e7%90%86%e8%a7%a3pe%e6%a0%bc%e5%bc%8f-%e6%89%8b%e5%b7%a5%e5%88%86%e6%9e%90pe%e6%96%87%e4%bb%b6%e6%89%be%e5%87%bape%e4%b8%addll%e5%92%8c%e5%87%bd%e6%95%b0%e7%9a%84%e4%bd%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/blog.73007300.xyz\/?p=50","title":{"rendered":"\u7406\u89e3PE\u683c\u5f0f\u2014\u2014\u624b\u5de5\u5206\u6790pe\u6587\u4ef6\u627e\u51faPe\u4e2ddll\u548c\u51fd\u6570\u7684\u4f4d\u7f6e"},"content":{"rendered":"\n<p>VIrtual Size\u662f\u52a0\u8f7d\u5230\u5185\u5b58\u7684\u5927\u5c0f<br> Raw Size\u662f\u6587\u4ef6\u4e2d\u504f\u79fb\u7684\u5927\u5c0f<\/p>\n\n\n\n<p>\u4ee5XP\u4e0a\u7684notepad.exe\u4e3a\u4f8b(\u52a0\u5bc6\u89e3\u5bc6\u7b2c\u5341\u4e00\u7ae0)<\/p>\n\n\n\n<p><a href=\"https:\/\/73007300.xyz\/notepad.exe\">https:\/\/73007300.xyz\/notepad.exe<\/a><\/p>\n\n\n\n<p>\u672c\u6587\u4f7f\u7528010Editor\u505a\u8f85\u52a9\u5206\u6790\u3002<\/p>\n\n\n\n<p>\u627ePE\u6587\u4ef6\u91cc\u7684dll\u51fd\u6570\u548c\u5730\u5740\uff1a<br> \u6587\u4ef6\u4ece0h \u5f00\u59cb+3ch\u7684\u503c\uff0c\u6307\u5411\u4e86NtHeader<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1698\" height=\"935\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-1.png\" alt=\"\" class=\"wp-image-21\"\/><figcaption><br><\/figcaption><\/figure>\n\n\n\n<p>notepad.exe<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"601\" height=\"388\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-2.png\" alt=\"\" class=\"wp-image-22\"\/><\/figure>\n\n\n\n<p>NtHeader\u7684+04h\u5904\u53ef\u4ee5\u5224\u65adPE\u6587\u4ef6\u65f6\u8fd0\u884c\u572832\u4f4d\u5e73\u53f0\u8fd8\u662f64\u4f4d\u5e73\u53f0\uff0c\u957f\u5ea62h\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"617\" height=\"489\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-3.png\" alt=\"\" class=\"wp-image-23\"\/><\/figure>\n\n\n\n<p>\u5176\u4e2d\u6570\u503c\u5bf9\u5e94\u7684\u89e3\u91ca\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1843\" height=\"1771\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-4.png\" alt=\"\" class=\"wp-image-24\"\/><\/figure>\n\n\n\n<p>pe\u6587\u4ef6\u91cc \u6570\u503c\u90fd\u662f\u4ece\u540e\u5f80\u524d\u8bfb\u7684\uff0c4C 01\u4ee3\u8868\u7684\u503c\u5c31\u662f\uff1a014C<\/p>\n\n\n\n<p>NtHeader\u7684+18h\u7684\u4f4d\u7f6e\u662fOptionalHeader\u7684\u4f4d\u7f6e<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"405\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-5.png\" alt=\"\" class=\"wp-image-25\"\/><\/figure>\n\n\n\n<p>32\u4f4d\u7684PE\u6587\u4ef6\u4e2d\uff1a<br> OptionalHeader\u7684IMAGE_DATA_DIRECTORY\u5728NtHeader\u7684+78h\u504f\u79fb\u5904\u3002<br> \u6570\u636e\u7ed3\u6784\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"1568\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-6.png\" alt=\"\" class=\"wp-image-26\"\/><\/figure>\n\n\n\n<p>notepad.exe:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"414\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-7.png\" alt=\"\" class=\"wp-image-27\"\/><\/figure>\n\n\n\n<p>64\u4f4d\u7684PE\u6587\u4ef6\u4e2d<br> OptionalHeader\u7684IMAGE_DATA_DIRECTORY\u5728NtHeader\u7684+88h\u504f\u79fb\u5904\uff1a<br> \u6570\u636e\u7ed3\u6784\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1700\" height=\"1718\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-8.png\" alt=\"\" class=\"wp-image-28\"\/><\/figure>\n\n\n\n<p>\u5728 IMAGE_DATA_DIRECTORY \u4e2d\uff0c\u6bcf\u4e00\u9879\u7684\u90fd\u662f\u5982\u4e0b\u6570\u636e\u7ed3\u6784\u7684\u5c55\u793a\u51fa\u6765\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1157\" height=\"221\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-9.png\" alt=\"\" class=\"wp-image-29\"\/><\/figure>\n\n\n\n<p>\u5728PEview\u91cc\u770b\u5230\u7684\u5c31\u662f\u8fd9\u79cd\u7ed3\u6784\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1083\" height=\"950\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-10.png\" alt=\"\" class=\"wp-image-30\"\/><\/figure>\n\n\n\n<p>\u7136\u540e\u627e\u5230Import Table\u7684\u4f4d\u7f6e\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1657\" height=\"1005\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-11.png\" alt=\"\" class=\"wp-image-31\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"599\" height=\"452\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-12.png\" alt=\"\" class=\"wp-image-32\"\/><\/figure>\n\n\n\n<p>RVA:7604h<br>\nSize:C8<br>\n\u4e00\u76f4\u5230NtHeader\u7ed3\u675f\uff0c\u6587\u4ef6\u504f\u79fb\u7684\u5927\u5c0f\uff08Raw Offset\uff09\u548c\u6620\u5c04\u5230\u5185\u5b58\u4e2d\u7684\u5927\u5c0f\uff08Virtual Offset\uff09\u90fd\u5df2\u4e00\u6837\u957f\u7684\uff0c\u4e5f\u5c31\u662f\u504f\u79fb\u91cf\u4e00\u4e00\u5bf9\u5e94\u3002<br>\n\u4ece\u8fd9\u91cc\u5f00\u59cb\uff0c\u63a5\u4e0b\u6765\u7684\u533a\u5757\u8868\u90e8\u5206\u4f7f\u5f97Raw Offset\u548cVirtual Offset\u4e0d\u76f8\u7b49\u4e86\u3002<\/p>\n\n\n\n<p>\u6709\u4e24\u4e2a\u503c\u7279\u522b\u503c\u5f97\u5173\u6ce8\uff1a<br>\nNtHeader+38h\u7684\u503c\u6307\u5b9a\u4e86\u5185\u5b58\u4e2d\u7684\u5bf9\u9f50\u5927\u5c0f\u3002\u4e0d\u8db3\u6309\u8fd9\u4e2a\u5927\u5c0f\u8865\u8db3\u3002<br>\nNtHeader+3Ch\u7684\u503c\u6307\u5b9a\u4e86\u6587\u4ef6\u4e2d\u7684\u5bf9\u9f50\u5927\u5c0f\u3002<br>\n\u6211\u4eec\u5b89\u88c5\u7cfb\u7edf\u5206\u533a\u65f6\u5e38\u8bf4\u76844K\u5bf9\u9f50\uff0c\u5c31\u662f\u8fd9\u4e24\u4e2a\u503c\u5bf9\u9f50\u3002<\/p>\n\n\n\n<p>NtHeader+54h\u7684\u503c\u6307\u5b9a\u4e86\u6240\u6709\u5934\u7684\u603b\u5927\u5c0f\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"601\" height=\"451\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-13.png\" alt=\"\" class=\"wp-image-33\"\/><\/figure>\n\n\n\n<p>\u4e5f\u5c31\u662fSection data\u90e8\u5206\u4ece400h\u7684\u4f4d\u7f6e\u5f00\u59cb\u3002<\/p>\n\n\n\n<p>NtHeader\u540e\u9762\u7d27\u8ddfSection Header,\u6839\u636e \u6570\u636e\u76ee\u5f55\u8868 \u63a8\u7b97\uff0cnotepad.exe\u7684Section Header\u662f\u4eceNtHeader +F8h\u5904\u5f00\u59cb\uff0c\u4e5f\u5c31\u662f E0 + F8h = 1D8\u3002<br> Section Header\u662f\u7531\u591a\u4e2aSection Header\u7ec4\u6210\u7684\u30021D8h\u5904\u5373\u4f7f\u7b2c\u4e00\u4e2asection header\u7684\u4f4d\u7f6e\u3002\u6bcf\u4e2asection header\u7684\u5927\u5c0f\u662f28h<br> \u4ece1D8\u5f00\u59cb\u7684\u524d8\u4e2a\u5b57\u8282\u5bf9\u5e94\u7684\u662f\u8fd9\u90e8\u5206section\u7684Name\u7684ascii\u7801\u3002<br> notepad.exe\u4e2d\u662f.text<br> \u5fae\u8f6f\u4e00\u822c\u7528\u8fd9\u4e2a\u540d\u5b57\u7684section\u6765\u5b58\u4ee3\u7801\u3002\u4e4b\u540e\u518d\u504f\u79fb1\u4e2aDWORD\u5bf9\u5e94\u7684\u662fVirtualSize,\u5728notepad.exe\u4e2d\u4f4d\u4e8e1D8h + 8h + 4h\u7684\u4f4d\u7f6e\uff0c\u5176\u5927\u5c0f\u662f1000h<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"597\" height=\"453\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-14.png\" alt=\"\" class=\"wp-image-34\"\/><\/figure>\n\n\n\n<p>\u518d\u504f\u79fb1\u4e2aDWORD\u662fSize Of Raw Data\uff0c\u5176\u6307\u5b9a\u4e86\u8fd9\u90e8\u5206section\u7684\u5927\u5c0f\uff0c\u5927\u5c0f\u662f7800h\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"449\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-15.png\" alt=\"\" class=\"wp-image-35\"\/><\/figure>\n\n\n\n<p>\u518d\u504f\u79fb1\u4e2aDWORD\u5c31\u662fPointerToRawData\uff0c\u503c\u662f400h\uff0c\u4ed6\u4ee3\u8868\u7684\u662f\u5728\u6587\u4ef6\u504f\u79fb\u4e2d\u7684\u4f4d\u7f6e\uff0c\u4e5f\u5c31\u662f\u56fe\u4e2d\u5de6\u4fa7\u90a3\u4e00\u5217\u7684\u5730\u5740\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"596\" height=\"454\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-16.png\" alt=\"\" class=\"wp-image-36\"\/><\/figure>\n\n\n\n<p>.text\u7684section header:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"\"><tbody><tr><td>VirtualSize<\/td><td>1000h<\/td><\/tr><tr><td>PointerToRawData<\/td><td>400h<\/td><\/tr><tr><td>Size Of Raw Data<\/td><td>7800h<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Import Table\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"\"><tbody><tr><td>RVA<\/td><td>7604h<\/td><\/tr><tr><td>Size<\/td><td>C8<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u7531\u4e8e.text\u7684\u5927\u5c0f\u65f61000h\u5f00\u59cb\uff0c\u504f\u79fb7800h\u7684\u5927\u5c0f\uff0c7604h\u5728\u8fd9\u90e8\u5206\u5927\u5c0f\u4e2d\uff0c\u6240\u4ee5import table\u5c31\u5728.text\u91cc\u3002<br> \u53c2\u8003\u300a\u52a0\u5bc6\u89e3\u5bc6\u300b\u7b2c\u5341\u4e00\u7ae0\u7684\u4ecb\u7ecd\uff0c\u6b64\u65f6 \u5185\u5b58\u504f\u79fb - \u6587\u4ef6\u504f\u79fb \u7684\u5dee\u503c\u25b3k\u7684\u503c\u5c31\u662f\u25b3k= 1000h - 400h = C00h<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1479\" height=\"932\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-17.png\" alt=\"\" class=\"wp-image-37\"\/><\/figure>\n\n\n\n<p>\u6b64\u65f6RVA - \u25b3k= 7604h - C00h = 6A04 \uff0c6A04\u6307\u5411\u7684\u662f\u4e00\u4e2a\u8f93\u5165\u8868\u7ed3\u6784\uff0c\u4e00\u4e2a\u94fe\u72b6\u7684\u7ed3\u6784\uff0c\u4e5f\u5c31\u662f\u8fd9\u4e2a\u8f93\u5165\u8868\u7ed3\u6784\u5728\u6587\u4ef6\u4e0a\u7684\u4f4d\u7f6e\u3002<\/p>\n\n\n\n<p>\u8f93\u5165\u8868\u7ed3\u6784\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"956\" height=\"505\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-18.png\" alt=\"\" class=\"wp-image-38\"\/><\/figure>\n\n\n\n<p>notepad.exe\u76846A04\u4f4d\u7f6e\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"620\" height=\"485\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-19.png\" alt=\"\" class=\"wp-image-39\"\/><\/figure>\n\n\n\n<p>\u68b3\u7406\u4e00\u4e2a\u7ea2\u5708\u91cc\u7684\u8fd9\u4e2aIID\uff08Image_Import_Descriptor\uff09\u7ed3\u6784<\/p>\n\n\n\n<figure class=\"wp-block-table aligncenter\"><table class=\"\"><tbody><tr><td>OriginalFirstThunk<\/td><td>TimeDateStamp<\/td><td>ForwarderChain<\/td><td>Name<\/td><td>FirstThunk<\/td><\/tr><tr><td>7990<\/td><td>FFFFFFFF<\/td><td>FFFFFFFF<\/td><td>7AAC<\/td><td>12C4<\/td><\/tr><tr><td>\u7565<\/td><td>\u7565<\/td><td>\u7565<\/td><td>\u7565<\/td><td>\u7565<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u7136\u540e\u770b\u770b\u7b2c\u56db\u90e8\u5206\u6307\u5411\u7684Name\u662f\u4e0d\u662f\u4e00\u4e2adll\u540d\u79f0\u3002<br>\n\u7b2c\u56db\u90e8\u5206\u7684\u503c\u662f7AAC\u3002\u8fd9\u662f\u4e2a\u5185\u5b58\u4e2d\u7684\u4f4d\u7f6e\u3002File Offset = Virtual Offset - \u25b3k = 7AACh - C00h = 6EACh\u3002<br>\n\u67e5\u770bnotepad.exe\u4e2d\u76846EACh\u4e2d\u7684\u5185\u5bb9\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"608\" height=\"162\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-20.png\" alt=\"\" class=\"wp-image-40\"\/><\/figure>\n\n\n\n<p>\u7ed3\u679c\u548cCFF\u7684\u4e00\u81f4\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"913\" height=\"422\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-21.png\" alt=\"\" class=\"wp-image-41\"\/><\/figure>\n\n\n\n<p>\u6700\u540e\u4e00\u4e2aIID\u7ed3\u6784\u75280\u586b\u5145\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"607\" height=\"403\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-22.png\" alt=\"\" class=\"wp-image-42\"\/><\/figure>\n\n\n\n<p>OriginalFirstThunk \u6307\u5411\u7684\u662fINT\uff08Import Name Table\uff09\uff0c\u4e5f\u5c31\u662fdll\u4e2d\u7684\u51fd\u6570\u540d\u79f0\u8868<br>\nFirstThunk\u6307\u5411\u7684\u662fIAT(Import Address Table) \uff0c\u4e5f\u5c31\u662fdll\u4e2d\u51fd\u6570\u7684\u5730\u5740\u8868<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"497\" height=\"202\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-23.png\" alt=\"\" class=\"wp-image-43\"\/><\/figure>\n\n\n\n<p>\u4e0b\u9762\u6765\u770b\u770bOriginalFirstThunk \u6307\u5411\u7684\u51fd\u6570\u540d\u79f0\u5bf9\u4e0d\u5bf9\u3002<br>\nOriginalFirstThunk\u6307\u5411\u7684\u662f\u4e00\u4e2aImage_Thunk_Data\u7ed3\u6784\u7c7b\u578b\u7684\u5143\u7d20\u3002<br>\nImage_Thunk_Data = OriginalFirstThunk -  \u25b3k = 7990 - C00 = 6D90<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"605\" height=\"184\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-24.png\" alt=\"\" class=\"wp-image-44\"\/><\/figure>\n\n\n\n<p>\u7ea2\u6846\u4e2d\u6bcf\u4e2a\u6846\u5bf9\u5e94\u4e00\u4e2a\u51fd\u6570\u540d\u7684RVA\u3002<br>\n7A7A - C00 = 6E7A \uff087\uff09<br>\n7A5E - C00 = 6E5E \uff085\uff09\u202c<br>\n7A9E - C00 = 6E9E \uff089\uff09\u202c<br>\n7A50 - C00 = 6E50\u202c \uff084\uff09<br>\n7A40 - C00 = 6E40 \uff083\uff09<br>\n7A8A - C00 = 6E8A \uff088\uff09<br>\n7A6A - C00 = 6E6A\u202c \uff086\uff09<br>\n7A14 - C00 = 6E14 \uff081\uff09<br>\n7A2C - C00 = 6E2C \uff082\uff09<\/p>\n\n\n\n<p>\u8fd9\u4e9b\u865a\u5730\u5740\u6307\u5411\u7684\u662f\u4e00\u4e2a IMAGE_IMPORT_BY_NAME\u7ed3\u6784\u7684\u6570\u636e<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1004\" height=\"306\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-25.png\" alt=\"\" class=\"wp-image-45\"\/><\/figure>\n\n\n\n<p>\u4ee500\u7ed3\u675f\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"602\" height=\"277\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-26.png\" alt=\"\" class=\"wp-image-46\"\/><\/figure>\n\n\n\n<p>\u518d\u6765\u770bFirstThunk\u6307\u5411\u7684\u4f4d\u7f6e\u3002<br>\n12C4 -  \u25b3k = 12C4 - C00 = 6C4\u202c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"605\" height=\"123\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-27.png\" alt=\"\" class=\"wp-image-47\"\/><\/figure>\n\n\n\n<p>\u8fd9\u91cc\u8bb0\u5f55\u4e869\u4e2a\u865a\u5730\u5740\u300200\u7ed3\u675f\u3002<br>\n\u548cPeview\u663e\u793a\u7684\u4e00\u81f4\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"807\" height=\"600\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/11\/image-28.png\" alt=\"\" class=\"wp-image-48\"\/><\/figure>\n\n\n\n<p>\u5982\u679c\u60f3\u5f15\u7528\u7684dll\u4e0d\u88ab\u5217\u5728pe\u5934\u7684Import Table\u4e2d\uff0c\u90a3\u5c31\u8981\u52a8\u6001\u52a0\u8f7ddll\uff0c\u5e38\u7528\u7684\u51fd\u6570\u662f\u201cLoadLibrary\u201d\u548c\u201cGetProcAddress\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>VIrtual Size\u662f\u52a0\u8f7d\u5230\u5185\u5b58\u7684\u5927\u5c0f Raw Size\u662f\u6587\u4ef6\u4e2d\u504f\u79fb\u7684\u5927\u5c0f \u4ee5XP\u4e0a\u7684notepad.exe\u4e3a\u4f8b(\u52a0\u5bc6\u89e3\u5bc6\u7b2c\u5341\u4e00\u7ae0) https:\/\/73007300.xyz\/notepad.exe \u672c\u6587\u4f7f\u7528010Editor\u505a\u8f85\u52a9\u5206\u6790\u3002 \u627ePE\u6587\u4ef6\u91cc\u7684dll\u51fd\u6570\u548c\u5730\u5740\uff1a \u6587\u4ef6\u4ece0h \u5f00\u59cb+3ch\u7684\u503c\uff0c\u6307\u5411\u4e86NtHeader notepad.exe NtHeader\u7684+04h\u5904\u53ef\u4ee5\u5224\u65adPE\u6587\u4ef6\u65f6\u8fd0\u884c\u572832\u4f4d\u5e73\u53f0\u8fd8\u662f64\u4f4d\u5e73\u53f0\uff0c\u957f\u5ea62h\uff1a \u5176\u4e2d\u6570\u503c\u5bf9\u5e94\u7684\u89e3\u91ca\uff1a pe\u6587\u4ef6\u91cc \u6570\u503c\u90fd\u662f\u4ece\u540e\u5f80\u524d\u8bfb\u7684\uff0c4C 01\u4ee3\u8868\u7684\u503c\u5c31\u662f\uff1a014C NtHeader\u7684+18h\u7684\u4f4d\u7f6e\u662fOptionalHeader\u7684\u4f4d\u7f6e 32\u4f4d\u7684PE\u6587\u4ef6\u4e2d\uff1a OptionalHeader\u7684IMAGE_DATA_DIRECTORY\u5728NtHeader\u7684+78h\u504f\u79fb\u5904\u3002 \u6570\u636e\u7ed3\u6784\uff1a notepad.exe: 64\u4f4d\u7684PE\u6587\u4ef6\u4e2d OptionalHeader\u7684IMAGE_DATA_DIRECTORY\u5728NtHeader\u7684+88h\u504f\u79fb\u5904\uff1a \u6570\u636e\u7ed3\u6784\uff1a \u5728 IMAGE_DATA_DIRECTORY \u4e2d\uff0c\u6bcf\u4e00\u9879\u7684\u90fd\u662f\u5982\u4e0b\u6570\u636e\u7ed3\u6784\u7684\u5c55\u793a\u51fa\u6765\uff1a \u5728PEview\u91cc\u770b\u5230\u7684\u5c31\u662f\u8fd9\u79cd\u7ed3\u6784\uff1a \u7136\u540e\u627e\u5230Import Table\u7684\u4f4d\u7f6e\uff1a RVA:7604h Size:C8 \u4e00\u76f4\u5230NtHeader\u7ed3\u675f\uff0c\u6587\u4ef6\u504f\u79fb\u7684\u5927\u5c0f\uff08Raw Offset\uff09\u548c\u6620\u5c04\u5230\u5185\u5b58\u4e2d\u7684\u5927\u5c0f\uff08Virtual Offset\uff09\u90fd\u5df2\u4e00\u6837\u957f\u7684\uff0c\u4e5f\u5c31\u662f\u504f\u79fb\u91cf\u4e00\u4e00\u5bf9\u5e94\u3002 \u4ece\u8fd9\u91cc\u5f00\u59cb\uff0c\u63a5\u4e0b\u6765\u7684\u533a\u5757\u8868\u90e8\u5206\u4f7f\u5f97Raw Offset\u548cVirtual Offset\u4e0d\u76f8\u7b49\u4e86\u3002 \u6709\u4e24\u4e2a\u503c\u7279\u522b\u503c\u5f97\u5173\u6ce8\uff1a NtHeader+38h\u7684\u503c\u6307\u5b9a\u4e86\u5185\u5b58\u4e2d\u7684\u5bf9\u9f50\u5927\u5c0f\u3002\u4e0d\u8db3\u6309\u8fd9\u4e2a\u5927\u5c0f\u8865\u8db3\u3002 NtHeader+3Ch\u7684\u503c\u6307\u5b9a\u4e86\u6587\u4ef6\u4e2d\u7684\u5bf9\u9f50\u5927\u5c0f\u3002 \u6211\u4eec\u5b89\u88c5\u7cfb\u7edf\u5206\u533a\u65f6\u5e38\u8bf4\u76844K\u5bf9\u9f50\uff0c\u5c31\u662f\u8fd9\u4e24\u4e2a\u503c\u5bf9\u9f50\u3002 NtHeader+54h\u7684\u503c\u6307\u5b9a\u4e86\u6240\u6709\u5934\u7684\u603b\u5927\u5c0f\uff1a \u4e5f\u5c31\u662fSection data\u90e8\u5206\u4ece400h\u7684\u4f4d\u7f6e\u5f00\u59cb\u3002 NtHeader\u540e\u9762\u7d27\u8ddfSection Header,\u6839\u636e \u6570\u636e\u76ee\u5f55\u8868 \u63a8\u7b97\uff0cnotepad.exe\u7684Section Header\u662f\u4eceNtHeader +F8h\u5904\u5f00\u59cb\uff0c\u4e5f\u5c31\u662f E0 + F8h = [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,2],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/50"}],"collection":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50"}],"version-history":[{"count":6,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":95,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions\/95"}],"wp:attachment":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}