+-------------------------------+ | MS-DOS MZ header | +-------------------------------+ | MS-DOS Real-Mode Stub program | +-------------------------------+ | PE EXE Header | +-------------------------------+ | PE EXE Optional Header | +-------------------------------+ | section header #1 | +-------------------------------+ | section header #2 +------------------------- : : +------------------------------+ | section #1 | +------------------------------+ | section #2 +-------------------- : :
First important thing you need to know is that PE EXE
on disk looks very much the same like its memory image, when Loader (part of Windows
KERNEL that load and run files) load it there. Loader map files into virtual address
space. So, all you need is to know where and how Loader maps parts of PE file in memory
reserved for that.
Now is the time to explain what 'Relative Virtual Address' (RVA) means. RVA is simply an
offset from the beginning of mapped PE file. For example: if Loader maps some file from
address: 0x40000, and if RVA of some data is 0x464 than you can find it in memory on
virtual address: 0x40000 + 0x00464 = 0x40464. Also note that there is a relation between
RVA of data and its PE EXE file offset!
One more term is need to be explained: PE file section. Sections are continuous parts of
PE file with variable length which stays continuous in memory, after file loading.
Sections hold all raw data: code, data, resource info etc. When Loader load PE file and
map it into reserved memory then Loader put sections in memory in specific order. But it
does not touch sections and do not break them. Every section has its own purpose: some
hold code or data, but some are created by linker just for OS use.
Program USER32.DLL | | +-Import-----------------+ +-----------------+ | : | 0x77879426: | : | 0x401042: | 0x77879426 | -------------------> | GetMessage code | | : | | : | +------------------------+ +-----------------+ | | | | +-Code-------------------+ | : | 0x404408: | JMP DWORD PTR [401042] | | : | | : | | CALL GetMessage | (call 404408) | : | +------------------------+ | |
HNA IAT +---+ +------------------+ +---+ /->| |--->| 44 |<---| |<---\ | | | | "GetMessage" | | | | | +---+ +------------------+ +---+ | IMAGE_IMPORT_DESCRIPTOR | | |--->| 72 |<---| | | +-----------------+ | | | | "LoadIcon" | | | | | Characteristics |---/ +---+ +------------------+ +---+ | +-----------------+ | |--->| 19 |<---| | | | TimeDateStamp | | | |"TranslateMessage"| | | | +-----------------+ +---+ +------------------+ +---+ | | ForwarederChain | : : : | +-----------------+ | | Name |---> "USER32.DLL" | +-----------------+ | | FirstThunk |------------------------------------------------/ +-----------------+ :
Weird
<weird173@yahoo.com>
http://move.to/weird