Figure 1 - PE File

  • The CLR header stores information to indicate that the PE file is a .NET executable and the CLR data section contains metadata and Microsoft Intermediate Language (MSIL, or IL for short) code.
  • Every common language runtime–compliant development tool compiles its own source code into IL code. Because all development tools produce the same IL, regardless of the language in which their source code is written, differences in implementation are gone by the time they reach the common language runtime.
  • Metadata is data that is used to describe classes and what they can do, separate from the code of the class itself. It is important to understand that metadata is not part of the class in the same way that variables and methods are, but instead it is used to describe classes.The CLR uses metadata for many purposes including; locating and loading classes, laying out objects in memory, finding out what methods and properties a class has, enforcing security and discovering the class’s transactional behaviour. You can ask an object at runtime for this type of information such as its type, methods, properties, events and so on.Most of the metadata associated with a class is provided by the compilation process, but it is possible to create your own metadata items, called attributes, and attach them to your own classes.
  • IL code : Code the compiler produced as it compiled the source code. At runtime, the CLR compiles the IL into native CPU instructions.

  Ref: Programming Design Pattern and CLR Via C#.

PE File.的更多相关文章

  1. Delphi : Analyze PE file headers?

    Analyze PE file headers? { You'll need a OpenDialog to open a Exe-File and a Memo to show the file i ...

  2. Make the PE file consistent when code not changed

    参考:http://www.mouseos.com/assembly/06.html 参考:http://www.cnblogs.com/tk091/archive/2012/04/18/245617 ...

  3. Inject shellcode into PE file

    先声明这是不免杀的,只是演示. 哔哩哔哩视频 新增节 一般能实现特定功能的shellcode的长度都比较长,可以分到几个节上的空白区,但是这样麻烦啊,或者把最后一个节扩大,但是最后一个节一般没有执行的 ...

  4. 《Peering Inside the PE: A Tour of the Win32 Portable Executable File Format》阅读笔记二

    Common Sections The .text section is where all general-purpose code emitted by the compiler or assem ...

  5. dnSpy PE format ( Portable Executable File Format)

    Portable Executable File Format PE Format  微软官方的 What is a .PE file in the .NET framework? [closed] ...

  6. 利用PE数据目录的导入表获取函数名及其地址

    PE文件是以64字节的DOS文件头开始的(IMAGE_DOS_HEADER),接着是一段小DOS程序,然后是248字节的 NT文件头(IMAGE_NT_HEADERS),NT的文件头位置由IMAGE_ ...

  7. Load PE from memory(反取证)(未完)

      Article 1:Loading Win32/64 DLLs "manually" without LoadLibrary() The most important step ...

  8. PE病毒初探——向exe注入代码

    PE文件其实就是Windows可执行文件,关于它的一些简要介绍摘自百度: PE文件被称为可移植的执行体是Portable Execute的全称,常见的EXE.DLL.OCX.SYS.COM都是PE文件 ...

  9. 【PE结构】恶意代码数字签名验证

    说明 恶意代码数字签名验证功能,WinverityTrust.CryptQueryObject 代码实现 WinVerifyTrust //------------------------------ ...

随机推荐

  1. codeforces C. DZY Loves Sequences

    http://codeforces.com/contest/447/problem/C 题意:给你n个数的序列,然后让你改变其中的一个数,求得最长上升连续序列的长度值. 思路:先从左边开始求出连续递增 ...

  2. ORACLE数据缓冲区DB cache

    DB CACHE是以数据块为单位组织的缓冲区,数据库刚刚启动的时候,DB CACHE中几乎没有用户数据的缓冲,当会话访问数据库中的表或索引时,首先会检查DB CACHE中是否存在该数据,如果不存在,就 ...

  3. poj2752 bzoj3670

    2752这是一道关于next函数的题(其实好像也可以用后缀数组暴力搞搞,但大概会超时)根据next[i]=max{j} (s[0..j]=s[i-j..i] j<i)不难发现这正是某个串既是前缀 ...

  4. 【游戏框架】Phaser

    PhaserDesktop and Mobile HTML5 game framework Phaser Examples

  5. (转载)MySQL关键字ORDER BY的使用

    例子: mysql), d_id ), name ), age ), sex ), homeaddr )); // 可以看到首先按照d_id进行升序排列,排列好了之后, // 若d_id字段中有相同的 ...

  6. 初遇ping++

    运行遇到的bug java.lang.NoClassDefFoundError: Failed resolution of: Lcom/pingplusplus/android/PingppLog; ...

  7. SRM 387(1-250pt)

    DIV1 300pt 题意:有m种颜色的球若干个放在n个盒子里.每次操作可从一个盒子里拿出任意个球(不必同色),放进另一个盒子.要求终态为:1.最多有一个盒子里面装有不同色的球,该盒子成为joker ...

  8. BCTF赛后

    今天早上八点,BTCF第一届落幕.虽然没有熬夜coding但还是十分开心. 从收到超哥的邀请,到回头组队,一开始的十几人,最后演化为五人的精简小分队,到昨晚把所有有想法的题目全部搞定,十分的开心和欣慰 ...

  9. bzoj4448 SCOI2015 情报传递 message

    传送门bzoj4448 题解 离线之后构建树上主席树,每个点的线段树维护到根路径的信息,不用链剖(我的链剖只是拿来求\(\mathrm{lca}\)的),时空复杂度\(O(n\log{n})\). c ...

  10. 未能导入activex控件,请确保它正确注册

    这个错误"未能导入activex控件,请确保它正确注册"昨天下午让我和我同事花费了3个小时来调试这个错误,在使用VS2010的winfrom编程时加入com组件的时候,报这个错误( ...