读取exe文件信息. [英] read exe file information .

问题描述

从一开始我就听说exe包含3个主要部分，
.rcsc
.text
.data
-有时也这些
(.reloc)
(.ndata)
(.rdata)

exe文件以魔术信号"MZ"开头.
exe文件的入口为(EP).它具有导出表，导入表，校验和..

嗯嗯奇怪...

我的问题是如何打开exe文件以获取此信息，
打包程序，解包程序，pe扫描仪和AV都使用此概念来检查特定文件.

代码，欢迎记录任何内容.

感谢您阅读此胡言乱语.

_UPDATE _

例如:
考虑file.exe，
我想打开此文件并搜索特定的字节模式.

例如:?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
这是称为"$ pirit v1.5"的打包程序的字节模式.
??是通配符字节.

From the beginning i am hearing that exe consists of 3 main parts,
.rcsc
.text
.data
-some time these too
(.reloc)
(.ndata)
(.rdata)

exe file starts with magic sig "MZ".
exe file has an entry point called (EP).It has export table , import table, check-sums..

hummm strange...

My question is How do i open exe file to get this information,
packer , unpackers, pe scanner''s and AV''s are use this concept to examine a particular file.

code, documents any thing is welcome.

thanks for reading this gibberish.

_UPDATE_

For example :
Consider file.exe ,
i want to open this file and search for particular byte pattern.

For ex : ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
this is byte pattern for packer called "$pirit v1.5"
?? are wildcard bytes.

推荐答案

pirit v1.5"
??是通配符字节.

pirit v1.5"
?? are wildcard bytes.

在c#:

byte[] data = File.ReadAllBytes(@"F:\Temp\XXX.exe");

然后，您可以按需解析数据.
MSDN [

You can then parse the data as you will.
MSDN[^]

您可以在此处可以找到介绍材料，尤其是指向PE格式规范的有用链接:维基百科上的PE页面" [ ^ ].

You may find introductory material and above all, useful links to the PE format specifications here: "PE page at Wikipedia"[^].

这篇关于读取exe文件信息.的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！