- 93 -
tcef;(8) - PE Header IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT IMAGE_DIRECTORY_ENTRY_RESOURCE IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_SECURITY IMAGE_DIRECTORY_ENTRY_BASERELOC IMAGE_DIRECTORY_ENTRY_DEBUG IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_GLOBALPTR IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT IMAGE_DIRECTORY_ENTRY_IAT IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR IMAGE_NUMBEROF_DIRECTORY_ENTRIES
equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 16
LordPE rSm erlem exe zdkifwpfckudkMunfhr,fqdk&if yHk(9)twdkif; jrif&rSmyg/
yHk(9) yHk(9)udk Munfhr,fqdk&if tjyma&mif highlight jc,fxm;wJh 4ckrSty usefwJhtoHk;rjyKwJhtuGufae&m awGrSm oknawGeJU jynhfaewm awGU&rSmyg/
yHk(10) yHk(10)udkMunfhr,fqdk&if import directory udk yef;a&mifeJU jyxm;ygw,f/ yxrqHk; 4bytes uawmh 40000h (ajymif;jyefpDwmjzpfygw,f) jzpfygw,f/ Import directory &JU t&G,ftpm;uawmh 1CDCh bytes jzpfygw,f/ PE header &JUtpuae DWORD 80bytes [m tjrJwrf; import directory &JU RVA yJjzpfygw,f/ t0ga&mifuawmh resource directory jzpfjyD;? c&rf;a&mifuawmh TLS directory jzpfygw,f/ wduswJh directory wpfckudk xm;&SdzdkUtwGuf oifhtaeeJU data directory uaepjyD; virtual address udkwGufcsuf&ygr,f/ 'Dhaemufawmh b,f directory [m b,f section xJrSm&Sdw,fqdkwm odEdkifzdkU virtual