dos头、nt头和节表在LordPE中的显示：
->DOS Header
e_magic: 0x5A4D
e_cblp: 0x0090
e_cp: 0x0003
e_crlc: 0x0000
e_cparhdr: 0x0004
e_minalloc: 0x0000
e_maxalloc: 0xFFFF
e_ss: 0x0000
e_sp: 0x00B8
e_csum: 0x0000
e_ip: 0x0000
e_cs: 0x0000
e_lfarlc: 0x0040
e_ovno: 0x0000
e_res: 0x0000000000000000
e_oemid: 0x0000
e_oeminfo: 0x0000
e_res2: 0x0000000000000000000000000000000000000000
e_lfanew: 0x000000D0
->File Header
Machine: 0x014C (I386)
NumberOfSections: 0x0003
TimeDateStamp: 0x47D4FC40 (GMT: Mon Mar 10 09:15:44 2008)
PointerToSymbolTable: 0x00000000
NumberOfSymbols: 0x00000000
SizeOfOptionalHeader: 0x00E0
Characteristics: 0x010F
(RELOCS_STRIPPED)
(EXECUTABLE_IMAGE)
(LINE_NUMS_STRIPPED)
(LOCAL_SYMS_STRIPPED)
(32BIT_MACHINE)
->Optional Header
Magic: 0x010B (HDR32_MAGIC)
MajorLinkerVersion: 0x06
MinorLinkerVersion: 0x00 -> 6.00
SizeOfCode: 0x00003000
SizeOfInitializedData: 0x00003000
SizeOfUninitializedData: 0x00000000
AddressOfEntryPoint: 0x00001000
BaseOfCode: 0x00001000
BaseOfData: 0x00004000
ImageBase: 0x00400000
SectionAlignment: 0x00001000
FileAlignment: 0x00001000
MajorOperatingSystemVersion: 0x0004
MinorOperatingSystemVersion: 0x0000 -> 4.00
MajorImageVersion: 0x0000
MinorImageVersion: 0x0000 -> 0.00
MajorSubsystemVersion: 0x0004
MinorSubsystemVersion: 0x0000 -> 4.00
Win32VersionValue: 0x00000000
SizeOfImage: 0x0009E000
SizeOfHeaders: 0x00001000
CheckSum: 0x00000000
Subsystem: 0x0002 (WINDOWS_GUI)
DllCharacteristics: 0x0000
SizeOfStackReserve: 0x00100000
SizeOfStackCommit: 0x00001000
SizeOfHeapReserve: 0x00100000
SizeOfHeapCommit: 0x00001000
LoaderFlags: 0x00000000
NumberOfRvaAndSizes: 0x00000010
DataDirectory (16) RVA Size
------------- ---------- ----------
ExportTable 0x00000000 0x00000000
ImportTable 0x0000400C 0x00000028 (".rdata")
Resource 0x00000000 0x00000000
Exception 0x00000000 0x00000000
Security 0x00000000 0x00000000
Relocation 0x00000000 0x00000000
Debug 0x00000000 0x00000000
Copyright 0x00000000 0x00000000
GlobalPtr 0x00000000 0x00000000
TLSTable 0x00000000 0x00000000
LoadConfig 0x00000000 0x00000000
BoundImport 0x00000000 0x00000000
IAT 0x00004000 0x0000000C (".rdata")
DelayImport 0x00000000 0x00000000
COM 0x00000000 0x00000000
Reserved 0x00000000 0x00000000
->Section Header Table
1. item:
Name: .text
VirtualSize: 0x00000008
VirtualAddress: 0x00001000
SizeOfRawData: 0x00003000
PointerToRawData: 0x00001000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0x60000020
(CODE, EXECUTE, READ)
2. item:
Name: .rdata
VirtualSize: 0x0000006C
VirtualAddress: 0x00004000
SizeOfRawData: 0x00003000
PointerToRawData: 0x00004000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0x40000040
(INITIALIZED_DATA, READ)
3. item:
Name: .data
VirtualSize: 0x00096A38
VirtualAddress: 0x00007000
SizeOfRawData: 0x00097000
PointerToRawData: 0x00007000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)
代码在第1个节，只有两句，push 0和调用输入表中的ExitProcess退出，下面是W32Dasm的显示：
Disassembly of File: 1.exe
Code Offset = 00001000, Code Size = 00003000
Data Offset = 00007000, Data Size = 00097000
Number of Objects = 0003 (dec), Imagebase = 00400000h
Object01: .text RVA: 00001000 Offset: 00001000 Size: 00003000 Flags: 60000020
Object02: .rdata RVA: 00004000 Offset: 00004000 Size: 00003000 Flags: 40000040
Object03: .data RVA: 00007000 Offset: 00007000 Size: 00097000 Flags: C0000040
+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++
There Are No Menu Resources in This Application
+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++
There Are No Dialog Resources in This Application
+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules = 1 (decimal)
Import Module 001: KERNEL32.dll
+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++
Import Module 001: KERNEL32.dll
Addr:0000404E hint(036A) Name: VirtualAlloc
Addr:0000405E hint(00B7) Name: ExitProcess
+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)
+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 00401000 (1.exe File Offset:00005000)
//******************** Program Entry Point ********
:00401000 6A00 push 00000000
* Reference To: KERNEL32.ExitProcess, Ord:00B7h
|
:00401002 FF1504404000 Call dword ptr [00404004]
输入表在第2个节开头，剩下的包括第3个节在内全部都是0。
反复看了很久实在是不知道哪错了，请帮忙看看。
文件在附件中：
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
