PE笔记之NT头PE文件头

typedef struct _IMAGE_FILE_HEADER {

 

    WORD    Machine;                         　 //014C-IMAGE_FILE_MACHINE_I386

 

    WORD    NumberOfSections;                 　//PE节数量-0007个节

 

    DWORD   TimeDateStamp;                     //时间戳E72B4FA9

 

    DWORD   PointerToSymbolTable;              //指向符号表0000

 

    DWORD   NumberOfSymbols;                   //符号表数量0000

 

    WORD    SizeOfOptionalHeader;              //扩展PE头大小00E0

 

    WORD    Characteristics;                   //文件属性0102-IMAGE_FILE_32BIT_MACHINE|IMAGE_FILE_EXECUTABLE_IMAGE

 

} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;