EXE 标头中的奇怪值
我在 EXE 标头中看到了一个奇怪的值，
00000000 :4D 5A 90 00 03 00 00 00 - 04 00 00 00 FF FF 00 00
00000010 :B8 00 00 00 00 00 00 00 - 40 00 00 00 00 00 00 00
00000020 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00 <-
我不知道 A8 在偏移量 3C 处正在做什么，但如果我用零替换它，我的程序就不会执行。
那是什么？
您能给我一个完整的 MS DOS 标头（规范）的超链接吗？
I've seen a strange value placed in an EXE header
00000000 :4D 5A 90 00 03 00 00 00 - 04 00 00 00 FF FF 00 00
00000010 :B8 00 00 00 00 00 00 00 - 40 00 00 00 00 00 00 00
00000020 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00 <-
I don't know what A8 is doing at offset 3C but if I replace it with zeros my program doesn't execute.
What is that?
Could you give me a hyperlink to the full MS DOS header (spec)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我怀疑它是新PE头的偏移量，前30个奇数字节是MS-DOS头，0xA8所在文件的偏移量对应于结构体
IMAGE_DOS_HEADER中的字段值 0xA8 将成为新的
IMAGE_NT_HEADER的一部分，其中包含以下信息：DWORD Signature;IMAGE_FILE_HEADER FileHeader;IMAGE_OPTIONAL_HEADEROptionalHeader;前两个字节是可执行文件中的原始 MS-DOS 头，如以下常量所示：
IMAGE_NT_HEADER 具有此签名来标识它是 NT 平台的可执行文件
您将在头文件中找到所有这些信息称为
pe.h。发生的情况是您擦除了值 0xA8，加载程序找不到
IMAGE_NT_HEADERS因此失败。I suspect that it is the offset to the new PE header, the first 30 odd bytes are the MS-DOS header, that offset into the file where 0xA8 resides in corresponds to the field in the structure
IMAGE_DOS_HEADERcalledIt is that value 0xA8 would be part of the new
IMAGE_NT_HEADERwhich contains this information:DWORD Signature;IMAGE_FILE_HEADER FileHeader;IMAGE_OPTIONAL_HEADER OptionalHeader;The very first two bytes are the original MS-DOS header into the executable as shown by this constant:
The IMAGE_NT_HEADER has this signature to identify that it is an executable for NT platforms
You will find all this information in a header file called
pe.h.What happened there is you wiped out the value 0xA8, the loader could not find the
IMAGE_NT_HEADERSand hence failed.PE 的第一部分是 MSDOS 存根；在 0x3C（“A8”所在的位置）处有 PE 文件签名的偏移量。如果将其清零，加载程序将无法找到 PE 签名，并将拒绝加载它（或将其作为 MS-DOS 可执行文件加载，我没有尝试）。
有关详细信息，请参阅 PE 格式规范。
The first part of a PE is the MSDOS stub; at 0x3C (where your "A8" is) there's the offset to the PE file signature. If you zero it, the loader won't be able to find the PE signature, and will refuse to load it (or load it as just an MS-DOS executable, I didn't try).
For more information, see the PE format specifications.
偏移量 0x3c 处的 DWORD 是新 EXE 标头（又名 IMAGE_NT_HEADERS）的偏移量。因此，如果您更改此处的值，PE 加载程序将无法找到新的 EXE 标头。
DWORD at offset 0x3c is the offset of the new EXE header, aka IMAGE_NT_HEADERS. So if you change the value there, the PE loader cannot find the new EXE header.