IMAGE_NT_HEADERS

13

description

Section Data n. …. Section Data 2. Section Data n. …. Section Data 1. Section Data 2. Section Data 1. Section Header n. Section Header n. …. …. Section Header 2. Section Header 2. Section Header 1. Section Header 1. IMAGE_NT_HEADERS. IMAGE_OPTION_HEADER. IMAGE_NT_HEADERS. - PowerPoint PPT Presentation

Transcript of IMAGE_NT_HEADERS

Page 1: IMAGE_NT_HEADERS
Page 2: IMAGE_NT_HEADERS

IMAGE_NT_HEADERS

Section Data n

Section Data 2

Section Data 1

Section Header n

Section Header 2

Section Header 1

IMAGE_OPTION_HEADER

IMAGE_FILE_HEADER

Signature

MS-DOS Stub Program

IMAGE_DOS_HEADER

IMAGE_NT_HEADERS

Section Data n

Section Data 2

Section Data 1

Section Header n

Section Header 2

Section Header 1

IMAGE_OPTION_HEADER

IMAGE_FILE_HEADER

Signature

MS-DOS Stub Program

IMAGE_DOS_HEADER VADDR : 0x004000000

Page 3: IMAGE_NT_HEADERS
Page 4: IMAGE_NT_HEADERS
Page 5: IMAGE_NT_HEADERS
Page 6: IMAGE_NT_HEADERS
Page 7: IMAGE_NT_HEADERS
Page 8: IMAGE_NT_HEADERS
Page 9: IMAGE_NT_HEADERS
Page 10: IMAGE_NT_HEADERS
Page 11: IMAGE_NT_HEADERS

IMAGE_NT_HEADERS

Section .reloc

Section .rsrc

Section .data

Section .textIMAGE_SECTION_HEADER .rel

ocIMAGE_SECTION_HEADER .rsrcIMAGE_SECTION_HEADER .dat

aIMAGE_SECTION_HEADER .tex

tIMAGE_OPTION_HEADER

IMAGE_FILE_HEADER

Signature

MS-DOS Stub Program

IMAGE_DOS_HEADER

IMAGE_NT_HEADERS

IMAGE_OPTION_HEADER

IMAGE_FILE_HEADER

Signature

MS-DOS Stub Program

IMAGE_DOS_HEADER VA : 0x001000000

Section .reloc

Section .rsrc

Section .data

Section .text

IMAGE_SECTION_HEADER .reloc

IMAGE_SECTION_HEADER .rsrcIMAGE_SECTION_HEADER .dat

aIMAGE_SECTION_HEADER .tex

t

RVA : 0x000000000

FP : 0x000000000

VA : 0x001001000RVA :

0x000001000FP : 0x000000400

VA : 0x001A0000RVA :

0x00000A000FP : 0x000009400

VA : 0x0100D000RVA :

0x00000D000FP : 0x00000A400

VA : 0x01027000RVA :

0x000027000FP : 0x000024000

Page 12: IMAGE_NT_HEADERS
Page 13: IMAGE_NT_HEADERS