windows PE Header 的大小
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8193862/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
The size of a PE Header
提问by Idov
Is there a way to find out the size of a PE Header without reading all of it or the entire file?
有没有办法在不读取全部或整个文件的情况下找出 PE Header 的大小？
采纳答案by pezcode
You can calculate the total size of the PE header like this:
您可以像这样计算 PE 标头的总大小：
sizeof(Signature) + sizeof(FileHeader) + sizeof(OptionalHeader) + sizeof(SectionTable)
The file header always has the same size but the OptionalHeader's size can differ, as can the section table size.
文件头始终具有相同的大小，但 OptionalHeader 的大小可以不同，节表大小也是如此。
The OptionalHeader's size is stored in FileHeader.SizeOfOptionalHeader, and the section table size equals FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)
OptionalHeader 的大小存储在 中FileHeader.SizeOfOptionalHeader，节表大小等于FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)
And some C code:
还有一些C代码：
DWORD SizeOfPEHeader(const IMAGE_NT_HEADERS * pNTH)
{
return (offsetof(IMAGE_NT_HEADERS, OptionalHeader) + pNTH->FileHeader.SizeOfOptionalHeader + (pNTH->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)));
}
All you have to do is read the DOS header, get the PE offset (e_lfanew) and read PE.Signature + PE.FileHeader into memory. That's two reading operations of fixed size and you have all the info you need.
您所要做的就是读取 DOS 标头，获取 PE 偏移量 (e_lfanew) 并将 PE.Signature + PE.FileHeader 读入内存。这是两个固定大小的读取操作，您拥有所需的所有信息。
