[B! PE] IchiRokuのブックマーク

Sunshine's Homepage - RVA and Import Table

IchiRoku 2012/09/22

Windows
PE

リンク

Break Free of Code Deadlocks in Critical Sections Under Windows

SUMMARY The Win32 Porta ble Executable File Format (PE) was designed to be a standard executable format for use on all versions of the operating systems on all supported processors. Since its introduction, the PE format has undergone incremental changes, and the introduction of 64-bit Windows has required a few more. Part 1 of this series presented an overview and covered RVAs, the data directory,

IchiRoku 2012/09/21

PE
Windows

リンク

Break Free of Code Deadlocks in Critical Sections Under Windows

SUMMARY A good understanding of the Porta ble Executable (PE) file format leads to a good understanding of the operating system. If you know what's in your DLLs and EXEs, you'll be a more knowledgeable programmer. This article, the first of a two-part series, looks at the changes to the PE format that have occurred over the last few years, along with an overview of the format itself. After this upd

IchiRoku 2012/09/21

PE
Windows

リンク

アレ用の何か

サンプルプログラム(EnumImp.zip)のダウンロードインポート情報イメージファイルには、そのイメージファイルをロードする際に必要な DLL とその DLL からインポートする関数や変数の情報が含まれています。インポート関数や変数といちいち表現するのも面倒なので、便宜上インポートシンボルと言いますが、例えば、以下のコード: int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int) { return MessageBoxA(NULL, "World!", "Hello", MB_OK); } 上記のコードをコンパイルして出来上がった EXE ファイルでは下図のようなインポート情報が含まれることになります。見てのとおり、「USER32.DLL から MessageBoxA() API をインポートするよ」というデータです。KERNEL3

IchiRoku 2012/09/21

Import dll listの取得

PE
Windows

リンク

技術/Windows/PE(Portable Executable)フォーマットの実験 - Glamenv-Septzen.net

id: 708 所有者: msakamoto-sf 作成日: 2010-07-14 21:42:15 カテゴリ: Assem bler Windows hacks [ Prev ] [ Next ] [ 技術 ] Windowsで使われている実行ファイルのフォーマット、PE(Porta ble Executable)関連のトピック集。技術/Windows/PE(Porta ble Executable)フォーマットの実験/01, リンカオプション技術/Windows/PE(Porta ble Executable)フォーマットの実験/02, 再配置情報で遊ぼう！技術/Windows/PE(Porta ble Executable)フォーマットの実験/03, TinyPEまとめ技術/Windows/PE(Porta ble Executable)フォーマットの実験/04, 各種構造体のサイズこ

IchiRoku 2012/09/21

リンク

Driver PE Header ImageBase modified by OS Loader [Archive] - RCE Messageboard's Regroupment

IchiRoku 2012/09/21

リンク

July 2008 – KK's Blog

IchiRoku 2012/09/21

リンク

Inside Native Applications - Windows Sysinternals | Microsoft Docs

Inside Native Applications 11/01/2006 3 minutes to read Mark Russinovich Published: November 1, 2006 Introduction If you have some familiarity with NT's architecture you are probably aware that the API that Win32 applications use isn't the "real" NT API. NT's operating environments, which include POSIX, OS/2 and Win32, talk to their client applications via their own APIs, but talk to NT using the