목 차 1. 개요 2. PE(Portable Executable) 이란? 3. IMAGE_DOS_HEADER 4. IMAGE_NT_HEADER 1) IMAGE_FILE_HEADER 2) IMAGE_OPTIONAL_HEADER 3) IMAGE_DATA_DIRECTORY

Size: px

Start display at page:

Download "목 차 1. 개요 2. PE(Portable Executable) 이란? 3. IMAGE_DOS_HEADER 4. IMAGE_NT_HEADER 1) IMAGE_FILE_HEADER 2) IMAGE_OPTIONAL_HEADER 3) IMAGE_DATA_DIRECTORY"

서현 남
5 years ago
Views:

1 작성자 : 한서대학교 H.I.S.L 동아리진선호 sunho104@msn.com 본보고서의전부나일부를인용시반드시 [ 자료 : 한서대학교정보보호동아리 (H.I.S.L)] 를명시하여주시기바랍니다

2 목 차 1. 개요 2. PE(Portable Executable) 이란? 3. IMAGE_DOS_HEADER 4. IMAGE_NT_HEADER 1) IMAGE_FILE_HEADER 2) IMAGE_OPTIONAL_HEADER 3) IMAGE_DATA_DIRECTORY 5. Import Table 6. Export Table 7. IMAGE_SECTION_HEADER 8. 맺음말 - 2 -

3 - 3 -

4 M Z DOS 시그너처 PE 위치 IMAGE_DOS_HEADER 및도스호환데이터 DOS 호환데이터 P E \0 \0 COFF 헤더 IMAGE_NT_HEAER 옵션헤더 섹션테이블 IMAGE_SECTION_HEADER 섹션 #1 섹션 #2 SECTION 데이터

5 M Z <- DOS 시그너처 IMAGE_DOS_HEADER PE 포맷시작오프셋-> PE위치 DOS Stub Code "This program cannot be run in DOS mode" PE signature IMAGE_DOS_HEADER 및도스호환데이터 (64byte) IMAGE_NT_HEAER - 5 -

6 typedef struct_image_dos_header{ // DOS.EXE header WORD e_magic; // Magic number (MZ) WORD e_cblp; // Bytes on last page of file WORD e_cp; // Pages in file WORD e_crlc; // Relocations WORD e_cparhdr; // Size of header in paragraphs WORD e_minalloc; // Minimum extra paragraphs needed WORD e_maxalloc; // Maximum extra paragraphs needed WORD e_ss; // Initial (relative) SS value WORD e_sp; // Initial SP value WORD e_csum; // Checksum WORD e_ip; // Initial IP value WORD e_cs; // Initial (relative) CS value WORD e_lfarlc; // File address of relocation table WORD e_ovno; // Overlay number WORD e_res[4]; // Reserved words WORD e_oemid; // OEM identifier (for e_oeminfo) WORD e_oeminfo; // OEM information; e_oemid specific WORD e_res2[10]; // Resverved words WORD e_lfanew; // File address of new exe header (PE) } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; - 6 -

7 typedef struct_image_file_header{ WORD WORD DWORD DWORD DWORD WORD Machine; NumberOfSections; TimeDateStamp; PointerToSymbolTable; NumberOfSymbols;; SizeOfOptionalHeader; // 타겟머신타입 ( 예 Intel 의 80386) // 파일에포함된섹션수 // 파일제작일시 // 심볼테이블오프셋 // 심볼테이블의엔트리수 // 옵션헤더의크기 WORD Characteristics; // 파일속성플래그 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; - 7 -

8 typedef struct _IMAGE_OPTIONAL_HEADER { // Standard fields. WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; DWORD BaseOfData; // 기본필드 // OPTIONAL 시그니처 // 링커버전 // 링커버전 // 코드섹션들의사이즈의합 // 코드섹션제외초기화된사이즈 // 초기화안된데이터섹션의크기 // 엔트리포인트 RVA // 코드섹션 RVA // 데이터섹션 RVA // NT additional fields. DWORD ImageBase; // 이미지베이스 DWORD SectionAlignment; // 메모리페이지크기 (4K) DWORD FileAlignment; // 섹션들의정렬단위 WORD MajorOperatingSystemVersion; // 운영체제최소버전 WORD MinorOperatingSystemVersion; // 운영체제최소버전 WORD MajorImageVersion; // 유저정의파일버전 WORD MinorImageVersion; // 유저정의파일버전 WORD MajorSubsystemVersion; // 서브시스템의최소버전 WORD MinorSubsystemVersion; // 서브시스템의최소버전 DWORD Win32VersionValue; // ( 사용 ) DWORD SizeOfImage; // 메모리상의 PE 파일의총사이즈 DWORD SizeOfHeaders; // 디스크상에서의헤더의총사이즈 DWORD CheckSum; // 체크섬값 WORD Subsystem; // 서브시스템 WORD DllCharacteristics; // DLL 초기화함수 ( 현재사용 ) DWORD SizeOfStackReserve; // 스택예약크기 DWORD SizeOfStackCommit; // 스택초기수용크기 DWORD SizeOfHeapReserve; // 기본힙예약크기 DWORD SizeOfHeapCommit; // 기본힙초기수용크기 DWORD LoaderFlags; // ( 사용 ) DWORD NumberOfRvaAndSizes; // DIRECTORY 배열의원소개수 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; - 8 -

9 - 9 -

10 typedef struct _IMAGE_DATA_DIRECTORY { DWORD DWORD VirtualAddress; Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; // Directory Entries #define IMAGE_DIRECTORY_ENTRY_EXPORT #define IMAGE_DIRECTORY_ENTRY_IMPORT #define IMAGE_DIRECTORY_ENTRY_RESOURCE #define IMAGE_DIRECTORY_ENTRY_EXCEPTION #define IMAGE_DIRECTORY_ENTRY_SECURITY #define IMAGE_DIRECTORY_ENTRY_BASERELOC #define IMAGE_DIRECTORY_ENTRY_DEBUG #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR #define IMAGE_DIRECTORY_ENTRY_TLS #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT #define IMAGE_DIRECTORY_ENTRY_IAT #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR // Export Directory // Import Directory // Resource Directory // Exception Directory // Security Directory // Base Relocation Table // Debug Directory // Architecture // Specific Data // RVA of GP // TLS Directory // Load Configuration // Directory // Bound Import Directory // in headers // Import Address Table // Delay Load Import // Descriptors // COM Runtime descriptor

11 - 11 -

12 IMPORT TABLE OriginalFistThunk <- ILT #1 TimeDateStamp IMAGE_IMPORT _DESCRIPTOR ForwarderChain Name FirstThunk <- IAT #1 OriginalFistThunk <- ILT #2 TimeDateStamp IMAGE_IMPORT _DESCRIPTOR ForwarderChain Name FirstThunk <- IAT #2 NULL

13 typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; DWORD OriginalFirstThunk; }; DWORD TimeDateStamp; DWORD ForwarderChain; DWORD Name; DWORD FirstThunk; } IMAGE_IMPORT_DESCRIPTOR; typedef struct _IMAGE_THUNK_DATA32 { union { PBYTE ForwarderString; PDWORD Function; DWORD Ordinal; PIMAGE_IMPORT_BY_NAME AddressOfData; } u1; } IMAGE_THUNK_DATA32;

14 EXPORT TABLE Name Base NumberOfFuntions IMAGE_DIRECTORY _ENTRY_EXPORT NumberOfNames AddressOfFunctions AddressOfNames AddressOfNameOrdinals... Name Base NumberOfFuntions IMAGE_DIRECTORY _ENTRY_EXPORT NumberOfNames AddressOfFunctions AddressOfNames AddressOfNameOrdinals

15 typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; DWORD Base; DWORD NumberOfFunctions; DWORD NumberOfNames; DWORD AddressOfFunctions; // RVA from base of image DWORD AddressOfNames; // RVA from base of image DWORD AddressOfNameOrdinals; // RVA from base of image } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

16 Section Table Name VirtualAddress Section #1 SizeOfRawData PointerToRawData Characteristics Name VirtualAddress Section #2 SizeOfRawData PointerToRawData Characteristics Section #n

17 #define IMAGE_SIZEOF_SHORT_NAME 8 typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD VirtualSize; } Misc; DWORD VirtualAddress; DWORD SizeOfRawData; DWORD PointerToRawData; DWORD PointerToRelocations; DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; #define IMAGE_SIZEOF_SECTION_HEADER

18 - 18 -

19 참고서적 1. Windows 시스템실행파일의구조와원리 - 한빛미디어 2. API로배우는 Windows의구조 - 한빛미디어 KUCIS 교육 Reverse Engineering 교제 참고사이트 1. 지식뽐뿌질 %20II( 연재물 ) - zesrever 의지식펌프 OpenRCE

<4D F736F F D20B0ADB5BFC7F65FB1E2BCFAB9AEBCAD5F4645B1B8C1B620B1E2BCFAB9AEBCAD5F66726F6D E6B5F66696E F2E646F63>

<4D F736F F D20B0ADB5BFC7F65FB1E2BCFAB9AEBCAD5F4645B1B8C1B620B1E2BCFAB9AEBCAD5F66726F6D E6B5F66696E F2E646F63> 기술문서 08.10.24. 작성 PE 구조분석 Windows 계열 OS 의파일구성 (PE: Portable Executable) 작성자 : 동명대학교 THINK 강동현 (cari2052@gmail.com) 0. 시작하면서 -------------------------------------------------------------------------- p.02