The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler by Eagle Chris

Author:Eagle, Chris [Eagle, Chris]
Language: eng
Format: mobi, epub, pdf
Tags: COMPUTERS / Software Development & Engineering / General
Publisher: O'Reilly Distribution
Published: 2011-06-15T04:00:00+00:00

seg000:00000000 dw 5A4Dh ; e_magic

seg000:00000000 dw 90h ; e_cblp

seg000:00000000 dw 3 ; e_cp

seg000:00000000 dw 0 ; e_crlc

seg000:00000000 dw 4 ; e_cparhdr

seg000:00000000 dw 0 ; e_minalloc

seg000:00000000 dw 0FFFFh ; e_maxalloc

seg000:00000000 dw 0 ; e_ss

seg000:00000000 dw 0B8h ; e_sp

seg000:00000000 dw 0 ; e_csum

seg000:00000000 dw 0 ; e_ip

seg000:00000000 dw 0 ; e_cs

seg000:00000000 dw 40h ; e_lfarlc

seg000:00000000 dw 0 ; e_ovno

seg000:00000000 dw 4 dup(0) ; e_res

seg000:00000000 dw 0 ; e_oemid

seg000:00000000 dw 0 ; e_oeminfo

seg000:00000000 dw 0Ah dup(0) ; e_res2

seg000:00000000 dd 80h ; e_lfanew

The e_lfanew field has a value of 80h, indicating that a PE header should be found at offset 80h (128 bytes) into the database. Examining the bytes at offset 80h should reveal the magic number for a PE header, 50h 45h (PE), and allow us to build (based on our reading of the PE specification) and apply an IMAGE_NT_HEADERS structure at offset 80h into the database. A portion of the resulting IDA listing might look like the following:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.