PE文件结构

typedef struct _IMAGE_NT_HEADERS {
  DWORD                 Signature;  PE头标识 为固定的ascii码 PE\0\0
  IMAGE_FILE_HEADER     FileHeader;  标准PE头
  IMAGE_OPTIONAL_HEADER OptionalHeader;  扩展PE头
} IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;

typedef struct _IMAGE_FILE_HEADER {
  WORD  Machine;  PE文件运行的平台类型
  WORD  NumberOfSections;  文件中"节"的数量
  DWORD TimeDateStamp;
  DWORD PointerToSymbolTable;
  DWORD NumberOfSymbols;
  WORD  SizeOfOptionalHeader;  扩展PE头的长度
  WORD  Characteristics;   文件属性 如:DLL文件, EXE文件等
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;