August 2019
Intermediate to advanced
342 pages
9h 35m
English
After the DOS header and DOS stub, we find the PE header.
The PE header contains information about different sections used to store code and data, along with the requested imports from other libraries (DLLs) or the exports provided, in case the module is actually a library. Take a look at the following structure of the PE header:
typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader;} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
The FileHeader structure field describes the format of the file (that is, contents, symbols, and more), and its type is defined in the following structure:
typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections ...Read now
Unlock full access