작성자 : 한서대학교 H.I.S.L 동아리진선호 sunho104@msn.com 본보고서의전부나일부를인용시반드시 [ 자료 : 한서대학교정보보호동아리 (H.I.S.L)] 를명시하여주시기바랍니다. - 1 -
목 차 1. 개요 2. PE(Portable Executable) 이란? 3. IMAGE_DOS_HEADER 4. IMAGE_NT_HEADER 1) IMAGE_FILE_HEADER 2) IMAGE_OPTIONAL_HEADER 3) IMAGE_DATA_DIRECTORY 5. Import Table 6. Export Table 7. IMAGE_SECTION_HEADER 8. 맺음말 - 2 -
- 3 -
M Z DOS 시그너처 PE 위치 IMAGE_DOS_HEADER 및도스호환데이터 DOS 호환데이터 P E \0 \0 COFF 헤더 IMAGE_NT_HEAER 옵션헤더 섹션테이블 IMAGE_SECTION_HEADER 섹션 #1 섹션 #2 SECTION 데이터... - 4 -
M Z <- DOS 시그너처 IMAGE_DOS_HEADER PE 포맷시작오프셋-> PE위치 DOS Stub Code "This program cannot be run in DOS mode" PE signature IMAGE_DOS_HEADER 및도스호환데이터 (64byte) IMAGE_NT_HEAER - 5 -
typedef struct_image_dos_header{ // DOS.EXE header WORD e_magic; // Magic number (MZ) WORD e_cblp; // Bytes on last page of file WORD e_cp; // Pages in file WORD e_crlc; // Relocations WORD e_cparhdr; // Size of header in paragraphs WORD e_minalloc; // Minimum extra paragraphs needed WORD e_maxalloc; // Maximum extra paragraphs needed WORD e_ss; // Initial (relative) SS value WORD e_sp; // Initial SP value WORD e_csum; // Checksum WORD e_ip; // Initial IP value WORD e_cs; // Initial (relative) CS value WORD e_lfarlc; // File address of relocation table WORD e_ovno; // Overlay number WORD e_res[4]; // Reserved words WORD e_oemid; // OEM identifier (for e_oeminfo) WORD e_oeminfo; // OEM information; e_oemid specific WORD e_res2[10]; // Resverved words WORD e_lfanew; // File address of new exe header (PE) } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; - 6 -
typedef struct_image_file_header{ WORD WORD DWORD DWORD DWORD WORD Machine; NumberOfSections; TimeDateStamp; PointerToSymbolTable; NumberOfSymbols;; SizeOfOptionalHeader; // 타겟머신타입 ( 예 Intel 의 80386) // 파일에포함된섹션수 // 파일제작일시 // 심볼테이블오프셋 // 심볼테이블의엔트리수 // 옵션헤더의크기 WORD Characteristics; // 파일속성플래그 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; - 7 -
typedef struct _IMAGE_OPTIONAL_HEADER { // Standard fields. WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; DWORD BaseOfData; // 기본필드 // OPTIONAL 시그니처 // 링커버전 // 링커버전 // 코드섹션들의사이즈의합 // 코드섹션제외초기화된사이즈 // 초기화안된데이터섹션의크기 // 엔트리포인트 RVA // 코드섹션 RVA // 데이터섹션 RVA // NT additional fields. DWORD ImageBase; // 이미지베이스 DWORD SectionAlignment; // 메모리페이지크기 (4K) DWORD FileAlignment; // 섹션들의정렬단위 WORD MajorOperatingSystemVersion; // 운영체제최소버전 WORD MinorOperatingSystemVersion; // 운영체제최소버전 WORD MajorImageVersion; // 유저정의파일버전 WORD MinorImageVersion; // 유저정의파일버전 WORD MajorSubsystemVersion; // 서브시스템의최소버전 WORD MinorSubsystemVersion; // 서브시스템의최소버전 DWORD Win32VersionValue; // ( 사용 ) DWORD SizeOfImage; // 메모리상의 PE 파일의총사이즈 DWORD SizeOfHeaders; // 디스크상에서의헤더의총사이즈 DWORD CheckSum; // 체크섬값 WORD Subsystem; // 서브시스템 WORD DllCharacteristics; // DLL 초기화함수 ( 현재사용 ) DWORD SizeOfStackReserve; // 스택예약크기 DWORD SizeOfStackCommit; // 스택초기수용크기 DWORD SizeOfHeapReserve; // 기본힙예약크기 DWORD SizeOfHeapCommit; // 기본힙초기수용크기 DWORD LoaderFlags; // ( 사용 ) DWORD NumberOfRvaAndSizes; // DIRECTORY 배열의원소개수 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; - 8 -
- 9 -
typedef struct _IMAGE_DATA_DIRECTORY { DWORD DWORD VirtualAddress; Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; // Directory Entries #define IMAGE_DIRECTORY_ENTRY_EXPORT #define IMAGE_DIRECTORY_ENTRY_IMPORT #define IMAGE_DIRECTORY_ENTRY_RESOURCE #define IMAGE_DIRECTORY_ENTRY_EXCEPTION #define IMAGE_DIRECTORY_ENTRY_SECURITY #define IMAGE_DIRECTORY_ENTRY_BASERELOC #define IMAGE_DIRECTORY_ENTRY_DEBUG #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR #define IMAGE_DIRECTORY_ENTRY_TLS #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT #define IMAGE_DIRECTORY_ENTRY_IAT #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 // Export Directory // Import Directory // Resource Directory // Exception Directory // Security Directory // Base Relocation Table // Debug Directory // Architecture // Specific Data // RVA of GP // TLS Directory // Load Configuration // Directory // Bound Import Directory // in headers // Import Address Table // Delay Load Import // Descriptors // COM Runtime descriptor - 10 -
- 11 -
IMPORT TABLE OriginalFistThunk <- ILT #1 TimeDateStamp IMAGE_IMPORT _DESCRIPTOR ForwarderChain Name FirstThunk <- IAT #1 OriginalFistThunk <- ILT #2 TimeDateStamp IMAGE_IMPORT _DESCRIPTOR ForwarderChain Name FirstThunk <- IAT #2 NULL - 12 -
typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; DWORD OriginalFirstThunk; }; DWORD TimeDateStamp; DWORD ForwarderChain; DWORD Name; DWORD FirstThunk; } IMAGE_IMPORT_DESCRIPTOR; typedef struct _IMAGE_THUNK_DATA32 { union { PBYTE ForwarderString; PDWORD Function; DWORD Ordinal; PIMAGE_IMPORT_BY_NAME AddressOfData; } u1; } IMAGE_THUNK_DATA32; - 13 -
EXPORT TABLE Name Base NumberOfFuntions IMAGE_DIRECTORY _ENTRY_EXPORT NumberOfNames AddressOfFunctions AddressOfNames AddressOfNameOrdinals... Name Base NumberOfFuntions IMAGE_DIRECTORY _ENTRY_EXPORT NumberOfNames AddressOfFunctions AddressOfNames AddressOfNameOrdinals... - 14 -
typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; DWORD Base; DWORD NumberOfFunctions; DWORD NumberOfNames; DWORD AddressOfFunctions; // RVA from base of image DWORD AddressOfNames; // RVA from base of image DWORD AddressOfNameOrdinals; // RVA from base of image } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; - 15 -
Section Table Name VirtualAddress Section #1 SizeOfRawData PointerToRawData Characteristics Name VirtualAddress Section #2 SizeOfRawData PointerToRawData Characteristics...... Section #n... - 16 -
#define IMAGE_SIZEOF_SHORT_NAME 8 typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD VirtualSize; } Misc; DWORD VirtualAddress; DWORD SizeOfRawData; DWORD PointerToRawData; DWORD PointerToRelocations; DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; #define IMAGE_SIZEOF_SECTION_HEADER 40-17 -
- 18 -
참고서적 1. Windows 시스템실행파일의구조와원리 - 한빛미디어 2. API로배우는 Windows의구조 - 한빛미디어 3. 2008 KUCIS 교육 Reverse Engineering 교제 참고사이트 1. http://zesrever.xstone.org/category/ 지식뽐뿌질 %20II( 연재물 ) - zesrever 의지식펌프 2. http://www.openrce.org/reference_library/files/reference/pe%20format.pdf - OpenRCE - 19 -