经过大半个月参考和学习网上各位大神的文案，做了一款.dll和.exe的PE格式分析工具，此工具可以分析32位和64位系统下可执行文件。1.0版本略显粗造，请各路大神多多指导，也欢迎大家多多交流。

目前有5大板块:【DOS头信息】、【NT头信息】、【节表信息】、【数据目录表】、【地址计算】。（*含中文注解，底部有工具下载链接）

第一板块：【DOS头信息】：DOS头表的所有信息，显示DOS表下各成员

第二板块：【NT头信息】：分为【文件头信息】和【可选映像头信息】；

一：【文件头信息】：所含可执行文件的运行平台，文件生成时间，文件属性等文件信息，简单明了的了解文件所有信息；

二：【可选映像头信息】：信息量较大，映像头包含可执行文件程序执行入口的RVA，文件类型，函数何时被调用等等；

第三板块【节表信息】：使用下拉选项来显示每一个节的内存偏移地址，属性等等；

第四板块【数据目录表】：可执行文件的各种表的RVA，以及Size；含【导出表】、【导入表】、【重定位表】的详细信息；

一：【导出表】:可执行文件所导出的函数、地址信息等。

IMAGE_EXPORT_DIRECTORY 结构的重要成员：
DWORD NumberOfFunctions; // 所有的导出函数的个数
DWORD NumberOfNames; // 以名字导出的函数的个数
DWORD AddressOfFunctions; // 导出的函数地址表的RVA
DWORD AddressOfNames; // 导出的函数名称表的RVA
DWORD AddressOfNameOrdinals // 导出的函数序号表的RVA
找出所有的导出函数:

1.以NumberOfFunctions导出函数的个数为准，循环遍历函数地址表的RVA;
2.当找到函数地址表不为零时，嵌套循环以NumberOfNames 名字导出的函数的个数循环遍历函数的序号的 RVA；
3.如果函数地址的ＲＶＡ 和 函数的序号的 RVA相同的话，那么这就是函数名称的RVA，即可找到该地址的函数;

二：【导入表】：简单来说就是代表了该模块调用了哪些外部的API

IMAGE_IMPORT_DESCRIPTOR结构的重要成员：
DWORD OriginalFirstThunk; //导入名称表
DWORD FirstThunk; //导入地址表
//OriginalFirstThunk和FirstThunk都指向的是_IMAGE_THUNK_DATA32结构体
_IMAGE_THUNK_DATA32
{
DWORD ForwarderString; // PBYTE
DWORD Function; // PDWORD，导入函数的地址
DWORD Ordinal; // 序号
DWORD AddressOfData; //PIMAGE_IMPORT_BY_NAME，假如是函数名导入的，它指向另外一个结构体：PIMGE_IMPORT_BY_NAME
}
_IMAGE_IMPORT_BY_NAME
{
WORD Hint ; // 序号
BYTE Name[1]; // 函数名
}

找出所有的导入函数：

1.通过IMAGE_IMPORT_DESCRIPTOR结构的OriginalFirstThunk导入名称表参数，从RvaToOffset找到名称表_IMAGE_THUNK_DATA32的RVA
2.如果名称表的AddressOfData值不为零，增加名称表和地址表本身值大小，循环查找下一个，直到为0则退出。
3.在循环体本身判断：如果序号超出最大范围值，说明是以序号导入的；不然则是以函数名导入，将AddressOfData的RvaToOffset，便得到该函数名。

三：【重定位表】:地址的重定向表

IMAGE_BASE_RELOCATION结构的重要成员：
DWORD VirtualAddress； //要修正的数据的基地址，RVA
DWORD SizeOfBlock; //大小

获取所有的重定位信息：

1. 找到重定位表的地址后；
   2.当表地址和大小不为零时，循环遍历重定位信息，找到首个重定位信息，以该重定位的大小为主嵌套循环，找到该重定位的地址和重定位类型, 再将重定位信息加上SizeOfBlock，继续循环遍历下一块重定位信息;

第五板块【地址计算】： VA，RVA，OFFSET之间值的计算，显示此值的所在区块和字节内容；

工具下载地址：
a02K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4d9p5E0Z5M7K6u0Q4y4h3k6@1k6e0c8U0L8r3I4q4x3#2u0c8y4g2g2b7j5h3W2Y4i4K6y4r3i4K6y4o6k6h3#2Q4x3@1g2S2N6q4)9K6b7#2)9J5c8X3g2E0i4K6y4q4i4K6y4p5x3e0j5I4z5o6R3&6x3e0x3J5z5o6V1^5y4R3`.`.
提取码：1234；

以下为所参考和学习的资料链接：
PE格式概述：
[url=824K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3x3X3j5J5z5q4)9J5c8Y4m8Q4x3V1j5&6z5o6l9H3z5e0V1J5i4K6u0W2K9s2c8E0L8q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3N6%4N6%4i4K6u0W2j5$3&6T1L8r3!0Y4M7#2)9J5k6h3y4G2L8g2)9J5c8U0u0X3x3U0S2Q4x3V1k6H3i4K6u0r3z5e0R3H3x3o6V1&6x3W2)9J5k6h3S2@1L8h3I4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
[url=077K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4q4I4i4K6g2X3x3K6j5%4y4o6j5%4x3K6S2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0M7@1x3e0M7I4x3U0V1J5i4K6g2p5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4q4I4i4K6g2X3x3K6j5%4y4o6j5%4x3K6S2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0M7@1x3e0M7I4x3U0V1J5i4K6g2n7i4K6u0r3N6i4u0D9i4K6g2p5
DOS头学习资料:
[url=bf7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4m8^5L8e0t1#2x3U0g2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0x3&6z5o6V1#2y4o6R3%4i4K6g2p5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4m8^5L8e0t1#2x3U0g2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0x3&6z5o6V1#2y4o6R3%4i4K6g2n7i4K6u0r3N6i4u0D9i4K6g2p5
NT头学习资料：
[url=c1dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8X3y4Z5P5g2)9#2k6X3y4Z5k6h3&6&6j5h3&6Y4i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5^5x3o6M7$3z5o6j5#2y4q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3j5X3I4G2k6#2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1k6U0K9s2W2Q4y4h3k6U0K9r3g2F1P5h3q4F1k6#2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3z5o6l9%4y4U0R3$3y4e0c8Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
文件头学习资料：
[url=279K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8X3A6A6j5h3&6Y4M7h3W2F1x3e0p5#2i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5%4z5e0M7#2y4K6l9@1x3g2)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3j5X3I4G2k6#2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1k6B7K9h3q4F1k6%4q4A6L8U0p5I4y4g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3y4K6V1%4y4e0M7H3y4o6q4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
[url=1bbK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4f1H3x3e0p5#2x3e0x3&6x3K6W2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0M7K6y4o6V1$3y4o6l9J5i4K6g2p5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4f1H3x3e0p5#2x3e0x3&6x3K6W2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0M7K6y4o6V1$3y4o6l9J5i4K6g2n7i4K6u0r3N6i4u0D9i4K6g2p5
[url=104K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8X3y4Z5P5g2)9#2k6X3y4Z5k6h3&6&6j5h3&6Y4i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5^5x3o6M7$3z5o6j5#2y4q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3j5X3I4G2k6#2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1k6U0K9s2W2Q4y4h3k6U0K9r3g2F1P5h3q4F1k6#2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3z5o6l9%4y4U0R3$3y4e0c8Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
可选映像头学习资料：
[url=e27K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8X3y4Z5P5g2)9#2k6X3y4Z5k6h3&6&6j5h3&6Y4i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5^5x3o6M7$3z5o6j5#2y4q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3j5X3I4G2k6#2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1k6U0K9s2W2Q4y4h3k6U0K9r3g2F1P5h3q4F1k6#2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3z5o6l9%4y4U0R3$3y4e0c8Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
[url=b23K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3K9%4g2S2L8X3N6C8k6g2)9J5c8Y4m8Q4x3V1j5#2x3K6V1K6y4e0p5@1i4K6u0W2K9s2c8E0L8q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3N6%4N6%4i4K6u0W2j5$3&6T1L8r3!0Y4M7#2)9J5k6h3y4G2L8g2)9J5c8X3E0#2j5h3&6Y4K9$3g2Q4x3V1k6H3i4K6u0r3y4e0x3&6x3K6f1I4y4q4)9J5k6h3S2@1L8h3I4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
节表信息学习资料：
[url=a09K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3d9f1#2&6e0r3W2X3k6g2)9J5c8Y4m8Q4x3V1j5@1z5o6t1$3x3o6V1H3i4K6u0W2K9s2c8E0L8q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3N6%4N6%4i4K6u0W2j5$3&6T1L8r3!0Y4M7#2)9J5k6h3y4G2L8g2)9J5c8V1W2y4P5f1I4A6k6X3g2Q4x3V1k6H3i4K6u0r3y4o6R3J5y4U0l9&6x3q4)9J5k6h3S2@1L8h3I4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
[url=e9eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3M7Y4g2A6L8X3N6C8K9h3&6Y4i4K6u0r3M7q4)9J5c8U0p5H3z5o6j5%4y4K6M7^5i4K6u0W2K9s2c8E0L8q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3N6%4N6%4i4K6u0W2j5$3&6T1L8r3!0Y4M7#2)9J5k6h3y4G2L8g2)9J5c8Y4u0#2K9h3&6Y4K9$3W2F1k6#2)9J5c8Y4m8Q4x3V1j5I4x3o6R3$3y4K6M7%4z5q4)9J5k6h3S2@1L8h3I4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
导入表学习资料：
[url=a07K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3f1%4g2F1M7$3g2@1f1W2)9J5c8Y4m8Q4x3V1j5I4x3e0p5&6x3U0f1#2y4g2)9J5k6h3S2@1L8h3I4Q4y4f1c8Z5N6s2c8H3M7#2)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4F1j5X3I4G2k6%4y4Q4x3X3g2U0L8$3#2Q4x3V1k6e0N6h3&6K6k6i4c8d9i4K6u0r3M7q4)9J5c8U0p5I4x3e0V1J5y4e0f1#2i4K6u0W2K9s2c8E0L8q4)9#2b7W2)9J5c8Y4g2J5L8q4)9#2c8l9`.`.
[url=477K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4N6W2K9i4S2A6L8W2)9#2k6U0b7J5y4o6R3&6y4e0R3J5i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5^5y4o6R3H3x3o6b7$3y4q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3j5X3I4G2k6#2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1k6%4k6h3W2^5K9h3&6Q4y4h3j5@1x3U0b7^5z5e0f1^5x3W2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3z5o6b7^5x3o6l9@1y4U0c8Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
导出表学习资料：
[url=fadK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3K9f1u0A6L8X3q4J5P5g2)9J5c8Y4m8Q4x3V1j5&6y4K6x3&6x3o6x3I4i4K6u0W2K9s2c8E0L8q4)9#2c8r3S2@1N6s2m8K6i4K6y4m8i4K6u0r3i4K6u0r3N6%4N6%4i4K6u0W2j5$3&6T1L8r3!0Y4M7#2)9J5k6h3y4G2L8g2)9J5c8X3W2n7K9h3&6S2M7Y4W2Q4x3V1k6H3i4K6u0r3z5e0M7K6z5e0l9K6x3g2)9J5k6h3S2@1L8h3I4Q4y4f1u0Q4x3V1k6#2M7X3I4Q4y4f1b7`.
[url=232K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4N6A6N6r3S2Q4y4h3k6V1M7X3g2S2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3V1k6V1k6i4c8S2K9h3I4K6i4K6u0r3z5o6p5I4y4o6b7@1z5e0k6Q4y4f1c8Z5N6s2c8H3M7#2)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2U0M7$3c8F1i4K6u0W2L8X3g2@1i4K6u0r3N6$3W2@1K9q4)9#2k6X3c8J5k6h3q4E0i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5^5x3e0p5@1y4o6b7&6y4W2)9#2b7W2)9J5c8Y4g2J5L8q4)9#2c8l9`.`.
重定位表学习资料：
[url=https://bbs.pediy.com/thread-246759.htm]https://bbs.pediy.com/thread-246759.htm[/url]
[url=b5fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4q4I4i4K6g2X3y4o6l9^5z5e0l9%4y4e0k6Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0V1H3x3o6R3H3z5o6R3H3i4K6g2p5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4q4I4i4K6g2X3y4o6l9^5z5e0l9%4y4e0k6Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0V1H3x3o6R3H3z5o6R3H3i4K6g2n7i4K6u0r3N6i4u0D9i4K6g2p5

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课