PE File.
Figure 1 - PE File
- The CLR header stores information to indicate that the PE file is a .NET executable and the CLR data section contains metadata and Microsoft Intermediate Language (MSIL, or IL for short) code.
- Every common language runtime–compliant development tool compiles its own source code into IL code. Because all development tools produce the same IL, regardless of the language in which their source code is written, differences in implementation are gone by the time they reach the common language runtime.
- Metadata is data that is used to describe classes and what they can do, separate from the code of the class itself. It is important to understand that metadata is not part of the class in the same way that variables and methods are, but instead it is used to describe classes.The CLR uses metadata for many purposes including; locating and loading classes, laying out objects in memory, finding out what methods and properties a class has, enforcing security and discovering the class’s transactional behaviour. You can ask an object at runtime for this type of information such as its type, methods, properties, events and so on.Most of the metadata associated with a class is provided by the compilation process, but it is possible to create your own metadata items, called attributes, and attach them to your own classes.
- IL code : Code the compiler produced as it compiled the source code. At runtime, the CLR compiles the IL into native CPU instructions.
Ref: Programming Design Pattern and CLR Via C#.
PE File.的更多相关文章
- Delphi : Analyze PE file headers?
Analyze PE file headers? { You'll need a OpenDialog to open a Exe-File and a Memo to show the file i ...
- Make the PE file consistent when code not changed
参考:http://www.mouseos.com/assembly/06.html 参考:http://www.cnblogs.com/tk091/archive/2012/04/18/245617 ...
- Inject shellcode into PE file
先声明这是不免杀的,只是演示. 哔哩哔哩视频 新增节 一般能实现特定功能的shellcode的长度都比较长,可以分到几个节上的空白区,但是这样麻烦啊,或者把最后一个节扩大,但是最后一个节一般没有执行的 ...
- 《Peering Inside the PE: A Tour of the Win32 Portable Executable File Format》阅读笔记二
Common Sections The .text section is where all general-purpose code emitted by the compiler or assem ...
- dnSpy PE format ( Portable Executable File Format)
Portable Executable File Format PE Format 微软官方的 What is a .PE file in the .NET framework? [closed] ...
- 利用PE数据目录的导入表获取函数名及其地址
PE文件是以64字节的DOS文件头开始的(IMAGE_DOS_HEADER),接着是一段小DOS程序,然后是248字节的 NT文件头(IMAGE_NT_HEADERS),NT的文件头位置由IMAGE_ ...
- Load PE from memory(反取证)(未完)
Article 1:Loading Win32/64 DLLs "manually" without LoadLibrary() The most important step ...
- PE病毒初探——向exe注入代码
PE文件其实就是Windows可执行文件,关于它的一些简要介绍摘自百度: PE文件被称为可移植的执行体是Portable Execute的全称,常见的EXE.DLL.OCX.SYS.COM都是PE文件 ...
- 【PE结构】恶意代码数字签名验证
说明 恶意代码数字签名验证功能,WinverityTrust.CryptQueryObject 代码实现 WinVerifyTrust //------------------------------ ...
随机推荐
- CABAC
CABAC(Context-based Adaptive Binary Arithmetic Coding),基于上下文的自适应二进制算术编码.CABAC是H.264/AVC标准中两种熵编码中的一种, ...
- 【HDOJ】2966 In case of failure
KD树,这东西其实在ML经常被使用,不过30s的时限还是第一次见. /* 2966 */ #include <iostream> #include <string> #incl ...
- Node.js权威指南 (1) - Node.js介绍
1.1 Node.js概述 / 2 1.1.1 使用Node.js能够解决什么问题 / 2 1.1.2 实现高性能服务器 / 2 1.1.3 非阻塞型I/O及事件环机制 / 2 1.1.4 Node. ...
- 【异步编程】when.js
异步编程:When.js快速上手 var api = 'http://qgy18.imququ.com/file/when/d.php?cb=?'; var getData = function() ...
- 大脑提取每一个体素26领域的matlab代码
%-------------- outer loop for x= 1:40 for y =1:48 for z =1:34 %----------inter loop x=20; y=30; z=1 ...
- 【转】Android ROM研究---Android build system增加模块
原文网址:http://hualang.iteye.com/blog/1141315 Android build system就是编译系统的意思 在我们需要向自己编译的源代码中增加模块的时候,需要一些 ...
- Google Map API 学习六
今天其实收货很大的 1.new google.maps.Circle 就是如何在地图上标注一个圆 3.getAnimation 在这里是通过获取Marker是否存在动作,然后如果存在动作的话,就将动作 ...
- Linux学习笔记4——函数调用栈空间的分配与释放
一.函数执行时使用栈空间作为自己的临时栈,3种方式决定编译器清空栈的方式:__stdcall. __fastcall.__cdecl 1.__stdcall表示每个调用者负责清空自己调用的函数的临时栈 ...
- 【转】Markus Persson:Minecraft 游戏背后的奇才
转自酷勤网 Markus Persson是沙盒游戏Minecraft的开发者,在游戏中以Notch的名字为众多玩家所知,是游戏界绝对的巨星.美国<滚石>杂志的专栏作家David Peisn ...
- [cocos2dx 3.0 + ios]如何编写iAd的plugin
cocos2dx3.0自带的plugin包含推广,收益等各个方面的第三方插件,但是对iAd没有支持,大概是因为专属于IOS,没有单独成库的必要,不过为了统一使用广告的插件化管理,封装一个专属IOS的I ...