找到原始入口点

发布于 2024-11-03 06:48:09 字数 833 浏览 1 评论 0原文

我希望能够通过查看 PE 头来找出出现在入口点的代码来自哪里。

例如，这段代码是我程序的起始代码（401000h）

00401000 >/$ 58             POP EAX                                  ;  kernel32.76E93677
00401001  |. 2D 77360100    SUB EAX,13677
00401006  |. BB 4A184000    MOV EBX,<JMP.&kernel32.VirtualProtect>

我想知道这段代码来自哪里。如何在不手动扫描文件的情况下找到它？（为了完成该示例，这里是来自同一文件的十六进制转储，代码现在位于 200h）

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000200   58 2D 77 36 01 00 BB 4A  18 40 00

如何从虚拟入口点 (401000h) 到达原始入口点 (200h)？我当然尝试自己解决它。但我错过了一些东西。起初我想：

.text[ Entrypoint (1000h) - VirtualOffset (1000d) ] = raw Entrypoint 由于文件对齐 = 200，并且原始入口点位于 .text 部分的开头，因此我认为可以将其用于所有可执行文件。

已解决，我在计算原始入口点时犯了愚蠢的错误

.text[ 入口点 - 虚拟偏移量 ] + 文件对齐 = 原始入口点（相对于 .text 部分）

原文

I want to be able to find out where the code appearing at the entry point comes from by looking at the PE header.

For example, this piece of code is the starting code of my program(401000h)

00401000 >/$ 58             POP EAX                                  ;  kernel32.76E93677
00401001  |. 2D 77360100    SUB EAX,13677
00401006  |. BB 4A184000    MOV EBX,<JMP.&kernel32.VirtualProtect>

I want to know where this code comes from. How can I find it without manually scanning my file? (to complete the example, here's an hexdump from the same file, the code now resides at 200h)

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000200   58 2D 77 36 01 00 BB 4A  18 40 00

How can I get from my virtual entry point (401000h) to the raw entry point (200h)?
I tried solving it myself of course. But I'm missing something. At first I thought:

.text[ Entrypoint (1000h) - VirtualOffset (1000d) ] = raw entrypoint
since the file alignment = 200, and the raw entry point was at the very start of my .text section, I thought I could use this for all the executables.

Solved, I made stupid mistakes when calculating the raw entry point

.text[ Entry point - Virtual offset ] + File Alignment = Raw entry point (relative to .text section)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

你的呼吸 2024-11-10 06:48:09

要自行查找文件中的偏移量，您需要查看 _IMAGE_NT_HEADERS 结构。从中您可以获得IMAGE_OPTIONAL_HEADER在哪里
您对 ImageBase 感兴趣的成员是。您可以使用 EditBin /REBASE 更改其值，因此几乎不需要推出自己的工具。

参考如何通过 dumpbin 确定入口点。

您可以使用
dumpbin /headers

dumpbin /headers \Windows\bfsvc

Dump of file \Windows\bfsvc.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4A5BBFB3 time date stamp Tue Jul 14 01:13:55 2009
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine

OPTIONAL HEADER VALUES
             10B magic # (PE32)
            9.00 linker version
            DE00 size of code
            2000 size of initialized data
               0 size of uninitialized data
            4149 entry point (01004149)
            1000 base of code
            F000 base of data
         1000000 image base (01000000 to 01011FFF)
            1000 section alignment
             200 file alignment

对于入口点，图像基值是相关的。但这仅适用于未启用 ASLR 的图像。为它们选择一个随机基地址（128 个不同基地址中的一个）。
指示图像是否启用 ASLR 的标志是 DLL 特性中设置的值 0x40。

8140 DLL characteristics

例如，对于 svchost.exe，它是为较旧的程序设置的，通常为 0。

您的，
阿洛伊斯·克劳斯

To locate the offset in the file by yourself you need to have a look at the _IMAGE_NT_HEADERS structure. From this you can get the IMAGE_OPTIONAL_HEADER where
the member you are interested in ImageBase is. You can change its value with EditBin /REBASE so there is little need to roll your own tool.

For reference how you can determine the entry point via dumpbin.

You can use
dumpbin /headers

dumpbin /headers \Windows\bfsvc

Dump of file \Windows\bfsvc.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4A5BBFB3 time date stamp Tue Jul 14 01:13:55 2009
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine

OPTIONAL HEADER VALUES
             10B magic # (PE32)
            9.00 linker version
            DE00 size of code
            2000 size of initialized data
               0 size of uninitialized data
            4149 entry point (01004149)
            1000 base of code
            F000 base of data
         1000000 image base (01000000 to 01011FFF)
            1000 section alignment
             200 file alignment

For the entry point the image base value is relevant. But this is only true for images that are not ASLR enabled. For them a random base address (1 of 128 different ones) is choosen.
The flag that indicates if an image is ASLR enabled is the value 0x40 which is set in DLL characteristics.