DOS头部
PE头和DOS头重合,DOS头部指向PE头的位置正好在选项头的节对齐位置,节对齐和文件对齐都设为4
0x8--0x1c之间是PE文件头
下面是重点,选项头部分
代码:
68 0c 00 40 00 ;push 0x0040000c(imageBase+0xc) 也就是c处的字符串 user32.dll e8 53 1d 40 7c ;call LoadLibraryA(0x7c401d5c) PE装载完后,Kernel32.dll会加载所以可以直接调用,此指令后地址为imageBase+0x28(0x00400028) LoadLibraryA地址为0x7C801D7B 减去0x00400028 得到0x7C401D53 6a 00 ;push 0 eb 1c ;jmp 0x00400048 (0x00400048 - 0x0040002c = 0x1c) 6a 00 ;push 0 eb 10 ;jmp 0x0040005c (0x0040005c - 0x0040004c = 0x10) 6a 00 ;push 0 eb d0 ;jmp 0x00400030 6a 00 ;push 0 eb 1c ;jmp 0x00400050 e8 95079577 ;call MessageBoxA (此地址算法和LoadLibraryA同理) c3 ;ret