当前位置：首页 > news >正文

PE文件格式

news 2025/9/27 15:14:17

概述

据说UEFI是参考了Windows去设计的，在UEFI中可以看到许多Windows的影子。其中UEFI程序采用的文件格式就是Windows环境下的PE格式。下面是其结构图：

在这里插入图片描述

DOS header

下面的结构体定义了DOS header的具体参数

///
/// PE images can start with an optional DOS header, so if an image is run
/// under DOS it can print an error message.
///
typedef struct {UINT16  e_magic;    ///< Magic number.UINT16  e_cblp;     ///< Bytes on last page of file.UINT16  e_cp;       ///< Pages in file.UINT16  e_crlc;     ///< Relocations.UINT16  e_cparhdr;  ///< Size of header in paragraphs.UINT16  e_minalloc; ///< Minimum extra paragraphs needed.UINT16  e_maxalloc; ///< Maximum extra paragraphs needed.UINT16  e_ss;       ///< Initial (relative) SS value.UINT16  e_sp;       ///< Initial SP value.UINT16  e_csum;     ///< Checksum.UINT16  e_ip;       ///< Initial IP value.UINT16  e_cs;       ///< Initial (relative) CS value.UINT16  e_lfarlc;   ///< File address of relocation table.UINT16  e_ovno;     ///< Overlay number.UINT16  e_res[4];   ///< Reserved words.UINT16  e_oemid;    ///< OEM identifier (for e_oeminfo).UINT16  e_oeminfo;  ///< OEM information; e_oemid specific.UINT16  e_res2[10]; ///< Reserved words.UINT32  e_lfanew;   ///< File address of new exe header.
} EFI_IMAGE_DOS_HEADER;

在这里插入图片描述

PE/COFF header

///
/// @attention
/// EFI_IMAGE_NT_HEADERS32 is for use ONLY by tools.
///
typedef struct {UINT32                      Signature;EFI_IMAGE_FILE_HEADER       FileHeader;EFI_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} EFI_IMAGE_NT_HEADERS32;///
/// COFF File Header (Object and Image).
///
typedef struct {UINT16  Machine;UINT16  NumberOfSections;UINT32  TimeDateStamp;UINT32  PointerToSymbolTable;UINT32  NumberOfSymbols;UINT16  SizeOfOptionalHeader;UINT16  Characteristics;
} EFI_IMAGE_FILE_HEADER;///
/// Optional Header Standard Fields for PE32.
///
typedef struct {////// Standard fields.///UINT16                    Magic;UINT8                     MajorLinkerVersion;UINT8                     MinorLinkerVersion;UINT32                    SizeOfCode;UINT32                    SizeOfInitializedData;UINT32                    SizeOfUninitializedData;UINT32                    AddressOfEntryPoint;UINT32                    BaseOfCode;UINT32                    BaseOfData;  ///< PE32 contains this additional field, which is absent in PE32+.////// Optional Header Windows-Specific Fields.///UINT32                    ImageBase;UINT32                    SectionAlignment;UINT32                    FileAlignment;UINT16                    MajorOperatingSystemVersion;UINT16                    MinorOperatingSystemVersion;UINT16                    MajorImageVersion;UINT16                    MinorImageVersion;UINT16                    MajorSubsystemVersion;UINT16                    MinorSubsystemVersion;UINT32                    Win32VersionValue;UINT32                    SizeOfImage;UINT32                    SizeOfHeaders;UINT32                    CheckSum;UINT16                    Subsystem;UINT16                    DllCharacteristics;UINT32                    SizeOfStackReserve;UINT32                    SizeOfStackCommit;UINT32                    SizeOfHeapReserve;UINT32                    SizeOfHeapCommit;UINT32                    LoaderFlags;UINT32                    NumberOfRvaAndSizes;EFI_IMAGE_DATA_DIRECTORY  DataDirectory[EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES];
} EFI_IMAGE_OPTIONAL_HEADER32;