1
2
3
4
5

typedef struct _IMAGE_NT_HEADERS64 {
    DWORD Signature; // PE 簽名
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;

1
2
3
4
5
6
7
8
9

 typedef struct _IMAGE_FILE_HEADER {
  WORD    Machine;                       // 平台，intel 386 為 0x014c，intel 64 為 0x0200
  WORD    NumberOfSections;              // Section 數量，最多 96 個字節
  DWORD   TimeDateStamp;                 // 編譯日期
  DWORD   PointerToSymbolTable;
  DWORD   NumberOfSymbols;
  WORD    SizeOfOptionalHeader;          // OptionalHeader 大小, 32 位通常為 E0，64 位通常為 F0
  WORD    Characteristics;               // 檔案屬性，EXE 通常為 010f，DLL 通常為 210e
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

typedef struct _IMAGE_OPTIONAL_HEADER {
    //
    // Standard fields.
    //

    WORD    Magic;                       // 簽名， 107h = ROM Image， 10Bh = EXE Image，20Bh = PE32+
    BYTE    MajorLinkerVersion;          // Linker 版本號
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;                  // 所有含有程式碼的 Section 大小
    DWORD   SizeOfInitializedData;       // 所有含有初始化數據的 Section 大小
    DWORD   SizeOfUninitializedData;     // 所有含位未始化數據的 Section 大小(不佔用檔案空間，載入記憶體後才會分配空間)
    DWORD   AddressOfEntryPoint;         // Process 執行入口 RVA(距離 PE 載入後地址的距離，病毒和加密程式都會修改其值，從而獲得程式的控制權；對於 DLL，如果沒有入口函式，那麼就是 0；對於驅動其值為初始化的函式地址)
    DWORD   BaseOfCode;                  // 程式碼的 Section 的起始 RVA(通常跟在 NT Header 後)
    DWORD   BaseOfData;                  // 數據的 Section 的起始 RVA 

    //
    // NT additional fields.
    //

    DWORD   ImageBase;                   // Process 建議的載入地址
    DWORD   SectionAlignment;            // 記憶體中的 Section 對齊值
    DWORD   FileAlignment;               // 檔案中的 Section 對齊值
    WORD    MajorOperatingSystemVersion; // OS 版本號
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;           // PE 版本號
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;       // 需要的 Subsystem 版本號
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;           // 未使用，必須為 0
    DWORD   SizeOfImage;                 // 記憶體中整個 PE 檔案的 image 大小
    DWORD   SizeOfHeaders;               // 所有的 Header 與 Section Header 加起來的大小
    DWORD   CheckSum;                    // 檢驗值，一般文件為 0，DLL 和 SYS 則會有其設定的值
    WORD    Subsystem;                   // 檔案子系統
    WORD    DllCharacteristics;          // DLL 檔案特性
    DWORD   SizeOfStackReserve;          // 初始化時保留的 stack 大小 (預設 1M)
    DWORD   SizeOfStackCommit;           // 初始化時實際給予的 stack 大小 (預設 4K)
    DWORD   SizeOfHeapReserve;           // 初始化時保留的 Heap 大小 (預設 1M)
    DWORD   SizeOfHeapCommit;            // 初始化時實際給予的 Heap 大小 (預設 4K)
    DWORD   LoaderFlags;                 // 加載旗幟，通常是 0
    DWORD   NumberOfRvaAndSizes;         // 數據目錄的數量
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; // 數據目錄的陣列
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

1
2

$ file PsExec.exe
PsExec.exe: PE32 executable (console) Intel 80386, for MS Windows, 5 sections

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

$ ./print_pe print_lib.exe

print_pe (January 15, 2023) - The DLL, EXE, OCX Analyzer
Copyright 2005-2022 - Michael Kohn  http://www.mikekohn.net/

---------------------------------------------
MS DOS Header
---------------------------------------------
      Magic Number: MZ
Bytes On Last Page: 144
     Pages In File: 3
       Relocations: 0
    Size Of Header: 4
    Min Extra Para: 0
    Max Extra Para: 65535
  Initial SS Value: 0
  Initial SP Value: 184
          Checksum: 0
  Initial IP Value: 0
  Initial CS Value: 0
  Addr Reloc Table: 64
    Overlay Number: 0
            OEM ID: 0
          OEM Info: 0
Addr Of New Header: 128

Signature: PE00

---------------------------------------------
Image File Header
---------------------------------------------
           Machine: 0x014c (i386)
  NumberOfSections: 16
     TimeDateStamp: Thu Jul 11 22:05:29 2024
PointerToSymbolTbl: 149504
   NumberOfSymbols: 951
 SizeOfOptionalHdr: 224
   Characteristics: 0x0107 (Relocations Stripped) (Executable Image) (Line Numbers Stripped) (32 Bit Machine)

---------------------------------------------
Image Optional Header
---------------------------------------------
             Magic: 0x010b (PE32 32 Bit Exe)
MajorLinkerVersion: 2
MinorLinkerVersion: 32
        SizeOfCode: 56832
...

1
2

reg query HKLM\SOFTWARE\Classes /s /f whatever.dll
if errorlevel 1 goto DLL_MISSING

1

regsvr32 your.dll

1

regsvr32 /u your.dll

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

#include <windows.h> 
#include <stdio.h> 
typedef int (__cdecl *MYPROC)(LPCWSTR); 
int main( void ) { 
    HINSTANCE hinstLib; 
    MYPROC ProcAdd; 
    BOOL fFreeResult, fRunTimeLinkSuccess = FALSE; 
    // Get a handle to the DLL module.
    hinstLib = LoadLibrary(TEXT("MyPuts.dll")); 
    // If the handle is valid, try to get the function address.
    if (hinstLib != NULL) { 
        ProcAdd = (MYPROC) GetProcAddress(hinstLib, "myPuts"); 
        // If the function address is valid, call the function.
        if (NULL != ProcAdd) {
            fRunTimeLinkSuccess = TRUE;
            (ProcAdd) (L"Message sent to the DLL function\n"); 
        }
        // Free the DLL module.
        fFreeResult = FreeLibrary(hinstLib); 
    } 
}

1
2

[DllImport("plugin.dll")]
public static extern void SomeFunction();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// link with /link /DELAYLOAD:MyDLL.dll /DELAY:UNLOAD
#include <windows.h>
#include <delayimp.h>
#include "MyDll.h"
#include <stdio.h>

#pragma comment(lib, "delayimp")
#pragma comment(lib, "MyDll")
int main()
{
    BOOL TestReturn;
    // MyDLL.DLL will load at this point
    fnMyDll();

    //MyDLL.dll will unload at this point
    TestReturn = __FUnloadDelayLoadedDLL2("MyDll.dll");

    if (TestReturn)
        printf_s("\nDLL was unloaded");
    else
        printf_s("\nDLL was not unloaded");
}

1
2

[DLLImport("dllName", CallingConvention = CallingConvention.StdCall)]
static extern int funcName(ref Int32 retVal);

1

extern "C" int __stdcall funcName(int* arg);