什么是pe阅读器上的物理地址?
逆向工程
拆卸
视窗
部件
ollydbg
聚乙烯
2021-07-10 11:03:30
1个回答
正如我评论似乎您使用的滥用一个名称的工具
的段头是记录这样
可以看出,结构的第二个成员是 Union Misc
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
所以你的工具可能应该将它用作 Misc.PhysicalAddress
或者它应该简单地将它用作 VirtualSize 因为 PhysicalAddress 与用户模式可执行文件无关(它曾经用于 obj 文件)
ollydbg 部分显示
013001F0 2E 74 65 78>ASCII ".text" ; SECTION
013001F8 8C6D0100 DD 00016D8C ; VirtualSize = 16D8C (93580.)
013001FC 00100000 DD 00001000 ; VirtualAddress = 1000
01300200 006E0100 DD 00016E00 ; SizeOfRawData = 16E00 (93696.)
01300204 00040000 DD 00000400 ; PointerToRawData = 400
01300208 00000000 DD 00000000 ; PointerToRelocations = 0
0130020C 00000000 DD 00000000 ; PointerToLineNumbers = 0
01300210 0000 DW 0000 ; NumberOfRelocations = 0
01300212 0000 DW 0000 ; NumberOfLineNumbers = 0
01300214 20000060 DD 60000020 ; Characteristics = CODE|EXECUTE|READ
windbg 部分显示
SECTION HEADER #1
.text name
16D8C virtual size
1000 virtual address
16E00 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
Dumpbin 或visualStudio Linker 显示部分
:\>dumpbin /section:.text cdb.exe
Microsoft (R) COFF/PE Dumper Version 14.16.27035.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file cdb.exe
File Type: EXECUTABLE IMAGE
SECTION HEADER #1
.text name
16D8C virtual size
1000 virtual address (00401000 to 00417D8B)
16E00 size of raw data
400 file pointer to raw data (00000400 to 000171FF)
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
Execute Read
Summary
17000 .text
根据 Matt Pietrek 窥视 pe 文章副本中的情况,该字段的使用情况
(微软只是将所有内容转储到一些排水沟中,并且只推广 Windows 10,因此我找不到 msdn 杂志的原件)
union {
DWORD PhysicalAddress
DWORD VirtualSize
} Misc;
This field has different meanings, in EXEs or OBJs. In an EXE,
it holds the actual size of the code or data. This is the size
before rounding up to the nearest file alignment multiple. The
SizeOfRawData field (seems a bit of a misnomer) later on in the
structure holds the rounded up value. The Borland linker reverses
the meaning of these two fields and appears to be correct. For OBJ
files, this field indicates the physical address of the section. The
first section starts at address 0. To find the physical address in
an OBJ file of the next section, add the SizeOfRawData value to the
physical address of the current section.
其它你可能感兴趣的问题
