此文章可以为初学者或以后的编程有用处。
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ?..........
00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ?......@.......
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00 ............?..
00000040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ..?.???L?Th
00000050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
00000060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
00000070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
00000080 ED 22 1F BF A9 43 71 EC A9 43 71 EC A9 43 71 EC ?.咯Cq飑Cq飑Cq?
00000090 27 5C 62 EC A4 43 71 EC 55 63 63 EC A8 43 71 EC '\b欷Cqcc歙Cq?
000000A0 6E 45 77 EC A8 43 71 EC 52 69 63 68 A9 43 71 EC nEw歙Cqichq?
000000B0 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 04 00 ........PE..L...
000000C0 DC 02 E8 4B 00 00 00 00 00 00 00 00 E0 00 0F 01 ?........?..
000000D0 0B 01 05 0C 00 04 00 00 00 0E 00 00 00 00 00 00 ................
000000E0 3A 10 00 00 00 10 00 00 00 20 00 00 00 00 40 00 :........ ....@.
000000F0 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 ................
00000100 04 00 00 00 00 00 00 00 00 50 00 00 00 04 00 00 .........P......
00000110 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 ................
00000120 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ................
00000130 00 00 00 00 00 00 00 00 24 20 00 00 50 00 00 00 ........$ ..P...
00000140 00 40 00 00 38 09 00 00 00 00 00 00 00 00 00 00 .@..8...........
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000190 00 20 00 00 24 00 00 00 00 00 00 00 00 00 00 00 . ..$...........
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001B0 2E 74 65 78 74 00 00 00 4E 02 00 00 00 10 00 00 .text...N.......
000001C0 00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
000001D0 00 00 00 00 20 00 00 60 2E 72 64 61 74 61 00 00 .... ..`.rdata..
000001E0 24 01 00 00 00 20 00 00 00 02 00 00 00 08 00 00 $.... ..........
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@
00000200 2E 64 61 74 61 00 00 00 AE 01 00 00 00 30 00 00 .data...?...0..
00000210 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 ................
00000220 00 00 00 00 40 00 00 C0 2E 72 73 72 63 00 00 00 ....@..?rsrc...
00000230 38 09 00 00 00 40 00 00 00 0A 00 00 00 0C 00 00 8....@..........
00000240 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@
00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000400 55 8B EC 56 57 51 8B 7D 10 8B 75 0C 8B 4D 08 83 UVWQ...?
00000410 F9 00 76 1F 3B 7E 0C 72 14 8B 46 0C 03 46 10 3B ?v.;~.r...F.;
00000420 F8 73 0A 2B 7E 0C 03 7E 14 8B C7 EB 06 83 C6 28 .+~..~.?(
00000430 49 EB DC 59 5F 5E C9 C2 0C 00 C7 05 44 30 40 00 I胲Y_^陕..?D0@.
00000440 4C 00 00 00 C7 05 50 30 40 00 1A 30 40 00 C7 05 L...?P0@..0@.?
00000450 60 30 40 00 90 30 40 00 C7 05 64 30 40 00 00 02 `0@.?@.?d0@...
00000460 00 00 C7 05 78 30 40 00 04 18 28 00 68 44 30 40 ..?x0@...(.hD0@
00000470 00 E8 D2 01 00 00 83 F8 00 0F 84 91 01 00 00 6A .枰........j
00000480 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 .h...j.j.j.h...
00000490 80 68 90 30 40 00 E8 95 01 00 00 83 F8 FF 0F 84 h?@.....?
000004A0 6C 01 00 00 6A 00 6A 00 6A 00 6A 02 6A 00 50 E8 l...j.j.j.j.j.P?
000004B0 82 01 00 00 83 F8 00 0F 84 53 01 00 00 6A 00 6A ?.......j.j
000004C0 00 6A 00 6A 04 50 E8 77 01 00 00 83 F8 00 0F 84 .j.j.P.....?
000004D0 3C 01 00 00 A3 90 31 40 00 8B 35 90 31 40 00 83 <...1@.??@.?
000004E0 C6 3C 8B 36 A1 90 31 40 00 03 F0 89 35 94 31 40 ??1@..5?@
000004F0 00 8B 35 94 31 40 00 83 C6 06 66 8B 16 0F BF D2 .??@..f?.恳
00000500 89 15 A6 31 40 00 8B 35 94 31 40 00 83 C6 18 89 ??@.??@..?
00000510 35 98 31 40 00 8B 35 94 31 40 00 83 C6 14 66 8B 5?@.??@..f?
00000520 16 0F BF D2 89 15 A2 31 40 00 8B 35 98 31 40 00 ..恳??@.??@.
00000530 03 35 A2 31 40 00 89 35 9C 31 40 00 8B 35 98 31 .5?@.??@.??
00000540 40 00 83 C6 68 8B 36 56 FF 35 9C 31 40 00 FF 35 @.h?V5?@.5
00000550 A6 31 40 00 E8 A7 FE FF FF 8B F8 8B F0 03 3D 90 ?@.瑙?.=?
00000560 31 40 00 83 7F 0C 00 0F 84 A3 00 00 00 83 7F 10 1@.?......?.
00000570 00 0F 84 99 00 00 00 83 C0 0C 03 05 90 31 40 00 ........?@.
00000580 8B 00 50 FF 35 9C 31 40 00 FF 35 A6 31 40 00 E8 ?P5?@.5?@.?
00000590 6C FE FF FF 03 05 90 31 40 00 6A 00 68 00 30 40 l?..?@.j.h.0@
000005A0 00 50 6A 00 E8 81 00 00 00 8B 47 10 50 FF 35 9C .Pj.....P5?
000005B0 31 40 00 FF 35 A6 31 40 00 E8 42 FE FF FF 03 05 1@.5?@.?..
000005C0 90 31 40 00 50 83 38 00 74 39 F7 00 00 00 00 80 ?@.P?.t9?...
000005D0 75 31 FF 30 FF 35 9C 31 40 00 FF 35 A6 31 40 00 u105?@.5?@.
000005E0 E8 1B FE FF FF 03 05 90 31 40 00 83 C0 02 6A 00 ??..?@..j.
000005F0 68 00 30 40 00 50 6A 00 E8 2D 00 00 00 58 83 C0 h.0@.Pj.?...X
00000600 04 EB C1 83 C7 14 83 C6 14 8B C6 E9 53 FF FF FF .肓..
00000610 6A 00 68 00 30 40 00 68 0F 30 40 00 6A 00 E8 07 j.h.0@.h.0@.j.?
00000620 00 00 00 6A 00 E8 12 00 00 00 FF 25 1C 20 40 00 ...j.?...%. @.
00000630 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 %. @.%. @.%.
00000640 40 00 FF 25 14 20 40 00 FF 25 00 20 40 00 00 00 @.%. @.%. @...
00000650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000800 02 21 00 00 00 00 00 00 B2 20 00 00 C0 20 00 00 .!......?..?..
00000810 D6 20 00 00 E4 20 00 00 00 00 00 00 98 20 00 00 ?..?......?..
00000820 00 00 00 00 90 20 00 00 00 00 00 00 00 00 00 00 ....?..........
00000830 A6 20 00 00 1C 20 00 00 7C 20 00 00 00 00 00 00 ?... ..| ......
00000840 00 00 00 00 F4 20 00 00 08 20 00 00 74 20 00 00 ....?... ..t ..
00000850 00 00 00 00 00 00 00 00 16 21 00 00 00 20 00 00 .........!... ..
00000860 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000870 00 00 00 00 02 21 00 00 00 00 00 00 B2 20 00 00 .....!......?..
00000880 C0 20 00 00 D6 20 00 00 E4 20 00 00 00 00 00 00 ?..?..?......
00000890 98 20 00 00 00 00 00 00 9D 01 4D 65 73 73 61 67 ?......?Messag
000008A0 65 42 6F 78 41 00 75 73 65 72 33 32 2E 64 6C 6C eBoxA.user32.dll
000008B0 00 00 30 00 43 72 65 61 74 65 46 69 6C 65 41 00 ..0.CreateFileA.
000008C0 31 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 1.CreateFileMapp
000008D0 69 6E 67 41 00 00 80 00 45 78 69 74 50 72 6F 63 ingA...ExitProc
000008E0 65 73 73 00 BA 01 4D 61 70 56 69 65 77 4F 66 46 ess.?MapViewOfF
000008F0 69 6C 65 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ile.kernel32.dll
00000900 00 00 0A 00 47 65 74 4F 70 65 6E 46 69 6C 65 4E ....GetOpenFileN
00000910 61 6D 65 41 00 00 63 6F 6D 64 6C 67 33 32 2E 64 ameA..comdlg32.d
00000920 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ll..............
00000930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000940 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000970 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000980 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000990 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000009F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000A00 6D 61 64 65 20 62 79 20 63 6F 72 72 65 79 00 77 made by correy.w
00000A10 69 6C 6C 20 6F 76 65 72 21 00 70 65 20 46 69 6C ill over!.pe Fil
00000A20 65 20 28 2A 2E 65 78 65 2C 20 2A 2E 64 6C 6C 29 e (*.exe, *.dll)
00000A30 00 2A 2E 65 78 65 3B 2A 2E 64 6C 6C 00 00 25 38 .*.exe;*.dll..%8
00000A40 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 x...............
00000A50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000A60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000A70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000A80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000A90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000AF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000B90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000BF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000C00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 ................
00000C10 03 00 00 00 28 00 00 80 0E 00 00 00 40 00 00 80 ....(......@..
00000C20 10 00 00 00 58 00 00 80 00 00 00 00 00 00 00 00 ....X..........
00000C30 00 00 00 00 00 00 01 00 01 00 00 00 70 00 00 80 ............p..
00000C40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00000C50 77 77 00 00 88 00 00 80 00 00 00 00 00 00 00 00 ww..?.........
00000C60 00 00 00 00 00 00 01 00 01 00 00 00 A0 00 00 80 ............?.
00000C70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00000C80 09 04 00 00 B8 00 00 00 00 00 00 00 00 00 00 00 ....?..........
00000C90 00 00 00 00 00 00 01 00 09 04 00 00 C8 00 00 00 ............?..
00000CA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00000CB0 09 04 00 00 D8 00 00 00 F0 40 00 00 E8 02 00 00 ....?....?..
00000CC0 00 00 00 00 00 00 00 00 D8 43 00 00 14 00 00 00 ..............
00000CD0 00 00 00 00 00 00 00 00 F0 43 00 00 48 05 00 00 ..........H...
00000CE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000CF0 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 (... ...@.......
00000D00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 ...............
00000D10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 ...............
00000D20 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 ..........
00000D30 80 80 00 00 80 80 80 00 C0 C0 C0 00 00 00 FF 00 ...览?...
00000D40 00 FF 00 00 00 FF FF 00 FF 00 00 00 FF 00 FF 00 ..........
00000D50 FF FF 00 00 FF FF FF 00 88 88 88 88 88 78 88 88 ...
00000D60 88 88 88 88 88 88 8F FF 88 88 88 88 88 88 88 88 ?
00000D70 88 88 88 88 88 88 8F F8 88 88 88 88 88 88 88 88
00000D80 88 88 88 88 88 88 8F F8 88 88 88 8F 88 88 77 77 ww
00000D90 77 77 88 88 88 88 8F FF 88 88 88 8F 88 77 77 77 ww?ww
00000DA0 77 77 77 88 88 FF FF FF 88 88 88 88 88 77 77 77 wwwww
00000DB0 77 77 78 88 88 FF FF FF 88 F8 88 88 88 78 88 88 wwx
00000DC0 88 88 88 88 88 FF FF FF 88 8F 88 88 88 88 88 88 ?
00000DD0 88 88 88 88 88 FF FF FF 88 88 88 88 88 88 88 88 ?
00000DE0 88 88 88 88 88 FF FF FF F8 88 88 88 88 88 88 88 ?
00000DF0 88 88 88 88 88 8F FF FF 8F FF F8 88 88 87 77 78 ?wx
00000E00 87 77 78 88 88 8F FF FF FF FF 88 88 88 88 88 88 x?
00000E10 88 88 88 88 88 88 FF FF FF 88 88 88 88 88 88 77 w
00000E20 77 78 88 88 88 88 8F FF FF F8 88 88 88 88 88 88 wx??
00000E30 88 88 88 88 88 88 88 FF FF F8 88 88 88 88 88 88 ??
00000E40 88 88 88 88 88 88 88 FF 8F 88 87 88 88 88 88 88 ?
00000E50 88 88 88 88 88 87 88 FF FF 87 77 88 88 88 88 88 ??
00000E60 88 88 88 88 88 87 78 FF F8 87 77 88 87 77 77 88 xwww?
00000E70 88 77 77 78 88 87 77 8F 88 77 77 78 78 88 87 88 wxwwwxx?
00000E80 88 88 88 88 88 77 77 88 88 77 77 78 77 77 77 88 wwwxwww?
00000E90 88 77 77 77 88 77 77 88 88 77 77 77 77 88 88 88 wwwwwww?
00000EA0 88 88 88 88 87 77 77 88 88 77 77 77 77 77 88 88 wwwwww
00000EB0 88 87 87 77 77 77 77 88 F8 87 77 77 77 77 77 77 wwwwwwww
00000EC0 77 77 77 77 77 77 78 8F FF 88 77 77 77 77 77 77 wwwwwwx?wwwww
00000ED0 77 77 77 77 77 77 88 FF FF 88 88 77 77 77 77 77 wwwwww?wwwww
00000EE0 77 77 77 77 78 88 88 FF FF 88 88 88 88 87 77 77 wwwwxw
00000EF0 77 88 88 8F F8 88 88 FF FF F8 88 88 88 88 8F FF w
00000F00 FF FF 88 8F 88 88 88 FF FF F8 88 88 88 88 88 FF ?
00000F10 FF 88 88 88 88 88 8F FF FF FF 88 88 88 88 88 88
00000F20 88 88 88 88 88 88 FF FF FF FF F8 88 88 88 88 88
00000F30 88 88 88 88 FF FF FF FF FF FF F8 88 88 88 88 88
00000F40 88 88 8F FF FF FF FF FF FF FF FF FF FF FF FF FF ?
00000F50 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 ........
00000F60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000F70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000F80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000F90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000FA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000FB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000FC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000FD0 00 00 00 00 00 00 00 00 00 00 01 00 01 00 20 20 ..............
00000FE0 10 00 01 00 04 00 E8 02 00 00 01 00 00 00 00 00 ......?........
00000FF0 48 05 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 H.4...V.S._.V.E.
00001000 52 00 53 00 49 00 4F 00 4E 00 5F 00 49 00 4E 00 R.S.I.O.N._.I.N.
00001010 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 F.O.....?稔....
00001020 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 ................
00001030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001040 00 00 00 00 00 00 00 00 00 00 00 00 A6 04 00 00 ............?..
00001050 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 ..S.t.r.i.n.g.F.
00001060 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 i.l.e.I.n.f.o...
00001070 82 04 00 00 01 00 30 00 34 00 30 00 39 00 30 00 ?....0.4.0.9.0.
00001080 34 00 45 00 34 00 00 00 9A 01 C1 00 01 00 43 00 4.E.4...??..C.
00001090 6F 00 6D 00 6D 00 65 00 6E 00 74 00 73 00 00 00 o.m.m.e.n.t.s...
000010A0 11 62 81 89 7E 62 00 4E 2A 4E BA 4E 2C 00 79 59 .b~b.N*N,.yY
000010B0 84 76 0D 54 57 5B EB 53 18 52 25 66 3D 4E 2C 00 .TW[.R%f=N,.
000010C0 79 59 84 76 18 5A B6 5B 2F 66 3A 00 B3 6C 57 53 yY.Z/f:.WS
000010D0 01 77 00 5F 01 5C 02 5E 5E 67 BF 53 8E 4E 08 FF .w._.\.^^g.
000010E0 09 57 09 FF 47 95 47 95 B0 65 84 5E 51 67 2C 00 .W.GeQg,.
000010F0 79 59 84 76 AB 8E FD 4E C1 8B F7 53 01 78 2F 66 yY.x/f
00001100 1A FF 34 00 31 00 30 00 32 00 32 00 31 00 31 00 .4.1.0.2.2.1.1.
00001110 39 00 38 00 31 00 30 00 31 00 32 00 33 00 34 00 9.8.1.0.1.2.3.4.
00001120 32 00 32 00 34 00 0C FF 79 59 31 5C FB 8B C7 8F 2.2.4..yY1\
00001130 84 76 66 5B 21 68 09 67 E1 4F 33 96 08 5E 03 83 f[!h.g3?^.?
00001140 66 5B 62 96 8C 54 09 54 97 67 27 59 66 5B 16 53 f[bT.T'Yf[.S
00001150 66 5B 66 5B 62 96 08 FF D8 9A 06 52 50 5B 16 53 f[f[b?.RP[.S
00001160 66 5B 0E 4E 69 72 06 74 84 76 55 78 EB 58 14 78 f[.Nir.tUx.x
00001170 76 7A 1F 75 09 FF 0C FF E5 82 E5 77 53 90 79 59 vz.u..SY
00001180 84 76 54 80 FB 7C B9 65 0F 5F 0C FF 82 59 1A FF T._..
00001190 30 57 40 57 01 30 35 75 DD 8B 01 30 4B 62 3A 67 0W@W.05u.0Kb:g
000011A0 01 30 35 75 50 5B E1 4F B1 7B 01 30 51 00 51 00 .05uP[.0Q.Q.
000011B0 49 7B 0C FF F7 8B 4A 54 C9 8B 11 62 0C FF 45 00 I{.JT.b.E.
000011C0 6D 00 61 00 69 00 6C 00 3A 00 6C 00 65 00 67 00 m.a.i.l.:.l.e.g.
000011D0 75 00 61 00 6E 00 79 00 75 00 61 00 6E 00 40 00 u.a.n.y.u.a.n.@.
000011E0 31 00 32 00 36 00 2E 00 63 00 6F 00 6D 00 16 62 1.2.6...c.o.m..b
000011F0 6C 00 65 00 67 00 75 00 61 00 6E 00 79 00 75 00 l.e.g.u.a.n.y.u.
00001200 61 00 6E 00 40 00 31 00 36 00 33 00 2E 00 63 00 a.n.@.1.6.3...c.
00001210 6F 00 6D 00 2C 00 C5 5F 09 67 CD 91 22 8C 02 30 o.m.,..g"?0
00001220 00 00 00 00 30 00 08 00 01 00 43 00 6F 00 6D 00 ....0.....C.o.m.
00001230 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 p.a.n.y.N.a.m.e.
00001240 00 00 00 00 63 00 6F 00 72 00 72 00 65 00 79 00 ....c.o.r.r.e.y.
00001250 20 00 00 00 40 00 10 00 01 00 46 00 69 00 6C 00 ...@.....F.i.l.
00001260 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 e.V.e.r.s.i.o.n.
00001270 00 00 00 00 6D 00 61 00 64 00 65 00 20 00 62 00 ....m.a.d.e. .b.
00001280 79 00 20 00 63 00 6F 00 72 00 72 00 65 00 79 00 y. .c.o.r.r.e.y.
00001290 20 00 00 00 46 00 0F 00 01 00 46 00 69 00 6C 00 ...F.....F.i.l.
000012A0 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 e.D.e.s.c.r.i.p.
000012B0 74 00 69 00 6F 00 6E 00 00 00 00 00 6D 00 61 00 t.i.o.n.....m.a.
000012C0 64 00 65 00 20 00 62 00 79 00 20 00 63 00 6F 00 d.e. .b.y. .c.o.
000012D0 72 00 72 00 65 00 79 00 00 00 00 00 3E 00 0F 00 r.r.e.y.....>...
000012E0 01 00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 ..I.n.t.e.r.n.a.
000012F0 6C 00 4E 00 61 00 6D 00 65 00 00 00 6D 00 61 00 l.N.a.m.e...m.a.
00001300 64 00 65 00 20 00 62 00 79 00 20 00 63 00 6F 00 d.e. .b.y. .c.o.
00001310 72 00 72 00 65 00 79 00 00 00 00 00 42 00 0F 00 r.r.e.y.....B...
00001320 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 ..L.e.g.a.l.C.o.
00001330 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 p.y.r.i.g.h.t...
00001340 6D 00 61 00 64 00 65 00 20 00 62 00 79 00 20 00 m.a.d.e. .b.y. .
00001350 63 00 6F 00 72 00 72 00 65 00 79 00 00 00 00 00 c.o.r.r.e.y.....
00001360 46 00 0F 00 01 00 4C 00 65 00 67 00 61 00 6C 00 F.....L.e.g.a.l.
00001370 54 00 72 00 61 00 64 00 65 00 6D 00 61 00 72 00 T.r.a.d.e.m.a.r.
00001380 6B 00 73 00 00 00 00 00 6D 00 61 00 64 00 65 00 k.s.....m.a.d.e.
00001390 20 00 62 00 79 00 20 00 63 00 6F 00 72 00 72 00 .b.y. .c.o.r.r.
000013A0 65 00 79 00 00 00 00 00 46 00 0F 00 01 00 4F 00 e.y.....F.....O.
000013B0 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 r.i.g.i.n.a.l.F.
000013C0 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 i.l.e.n.a.m.e...
000013D0 6D 00 61 00 64 00 65 00 20 00 62 00 79 00 20 00 m.a.d.e. .b.y. .
000013E0 63 00 6F 00 72 00 72 00 65 00 79 00 00 00 00 00 c.o.r.r.e.y.....
000013F0 3E 00 0F 00 01 00 50 00 72 00 6F 00 64 00 75 00 >.....P.r.o.d.u.
00001400 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 c.t.N.a.m.e.....
00001410 6D 00 61 00 64 00 65 00 20 00 62 00 79 00 20 00 m.a.d.e. .b.y. .
00001420 63 00 6F 00 72 00 72 00 65 00 79 00 00 00 00 00 c.o.r.r.e.y.....
00001430 42 00 0F 00 01 00 50 00 72 00 6F 00 64 00 75 00 B.....P.r.o.d.u.
00001440 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 c.t.V.e.r.s.i.o.
00001450 6E 00 00 00 6D 00 61 00 64 00 65 00 20 00 62 00 n...m.a.d.e. .b.
00001460 79 00 20 00 63 00 6F 00 72 00 72 00 65 00 79 00 y. .c.o.r.r.e.y.
00001470 00 00 00 00 3E 00 0F 00 01 00 50 00 72 00 69 00 ....>.....P.r.i.
00001480 76 00 61 00 74 00 65 00 42 00 75 00 69 00 6C 00 v.a.t.e.B.u.i.l.
00001490 64 00 00 00 6D 00 61 00 64 00 65 00 20 00 62 00 d...m.a.d.e. .b.
000014A0 79 00 20 00 63 00 6F 00 72 00 72 00 65 00 79 00 y. .c.o.r.r.e.y.
000014B0 00 00 00 00 3E 00 0F 00 01 00 53 00 70 00 65 00 ....>.....S.p.e.
000014C0 63 00 69 00 61 00 6C 00 42 00 75 00 69 00 6C 00 c.i.a.l.B.u.i.l.
000014D0 64 00 00 00 6D 00 61 00 64 00 65 00 20 00 62 00 d...m.a.d.e. .b.
000014E0 79 00 20 00 63 00 6F 00 72 00 72 00 65 00 79 00 y. .c.o.r.r.e.y.
000014F0 00 00 00 00 44 00 00 00 01 00 56 00 61 00 72 00 ....D.....V.a.r.
00001500 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 F.i.l.e.I.n.f.o.
00001510 00 00 00 00 24 00 04 00 00 00 54 00 72 00 61 00 ....$.....T.r.a.
00001520 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 n.s.l.a.t.i.o.n.
00001530 00 00 00 00 04 08 B0 04 00 00 00 00 00 00 00 00 ......?........
00001540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000015F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
从3c处得到b8
b8h+4+20+112=140h;是为资源数据目录的地址的地方。
在140h处得到4000(是rva），经转换得到a00h（在文件的位置）。
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
从a00开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有三个使用数字id来标示资源类型的资源目录项。
第一个的资源类型是3，也就是图标，不是叶子，下一层的资源目录表的地址是a28；
第二个的资源类型是e，也就是图标组，不是叶子，下一层的资源目录表的地址是a40；
第三个的资源类型是10h，也就是版本信息，不是叶子，下一层的资源目录表的地址是a58；
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
从a28开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源id的资源目录项。
第一个的资源id是1，不是叶子，下一层的资源目录表的地址是a70；
从a40开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源id的资源目录项。
第一个的资源id是7，不是叶子，下一层的资源目录表的地址是a88；
从a58开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源id的资源目录项。
第一个的资源id是1，不是叶子，下一层的资源目录表的地址是aa0；
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
从a70开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源代码页的资源目录项。
第一个的资源代码页是0409，是叶子，资源数据项的地址是ab8；
从a88开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源代码页的资源目录项。
第一个的资源代码页是0409，是叶子，资源数据项的地址是ac8；
从aa0开始的16字节的内容是一个资源目录表，
从这里得到紧跟着这个资源目录表的后面有一个使用数字id来标示资源代码页的资源目录项。
第一个的资源代码页是0409，是叶子，资源数据项的地址是ad8；
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
从ab8处的资源数据项得到此数据的rva为40f0,长度为02e8.
从ac8处的资源数据项得到此数据的rva为43d8,长度为0014.
从ab8处的资源数据项得到此数据的rva为43f0,长度为0548.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
至此分析结束，有不好的地方，敬请指导。
参考资料：
Microsoft 可移植可执行文件和通用目标文件格式文件规范 修订版8.0 － 2006年5月16日
Windows环境下32位汇编语言程序设计 罗云彬
作者信息：
made by correy
made in 2010.05.11
QQ:112426112
Email:leguanyuan@126.com
Websites:http://correy.webs.com
- 标 题：手工分析pe文件的资源
- 作 者：correy
- 时 间：2010-05-13 14:49:57
- 链 接：http://bbs.pediy.com/showthread.php?t=112934