PE文件结构和调试

2024-01-16 20:46:40

1.PE文件结构

[参考文章](https://blog.csdn.net/adam001521/article/details/84658708)

1.1结构地址偏移

hMod = GetModuleHandle(NULL);
pAddr = (PBYTE)hMod;
		PrintImportTable(pAddr);
		// pAddr = VA to PE signature (IMAGE_NT_HEADERS) 
		pAddr += *((long long*)&pAddr[0x3C]);

		// dwRVA = RVA to IMAGE_IMPORT_DESCRIPTOR Table  
		dwRVA = *((long long*)&pAddr[0x80]);