af7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1M7s2y4W2L8X3c8Q4x3X3g2F1k6i4c8Q4x3V1k6@1K9s2u0W2j5h3c8Q4x3X3b7K6y4o6k6Q4x3X3b7I4i4K6u0V1x3g2)9J5k6h3S2@1L8h3H3`.myWinPE.exe文件创建流程DOS_HEADER部分内容Dos头中间有 大量 无用数据,可以把 NT 头数据拷到 dos 头 偏移位4的位置,然后修改 dos头 指向 NT头的偏移但是全部拷贝放不下,因此只能拷贝一部分,到导入表结束(因为后面的数据表没用)NT头的FILE_HEADER部分内容NT头的OPTIONAL_HEADER部分内容节表部分内容基础PE内容总览写入库名和函数名修改导入表,导入表占 20字节 但前面 12个字节都没用上述操作之后的代码点击运行发现报错,说明我们的代码有问题用OD 查看,发现导入函数并没有加载进来,说明我们的导入表构件的有问题初步检查发现如下错误继续寻找错误并把没用的数据用CC填充还是有错误,继续寻找继续找错误再到OD去看,可以看到函数已经加载进来了说明我们格式已经对了,接下来就是写代码了函数入口点,之所以跳到 64,因此哪里空间多一点,可以写代码运行发现只有标题没有内容,怀疑可能是栈被破坏了有一个标志 Win32VersionValue ,xp必须为0,win7 和win10不用管点击发现功能实现了还可以继续减少大小因为系统准备内存会在里面填充0 , 因为后面的0可以全部删除 ,又因为 第一个节就算不给属性系统也会自动给,所以也可以不要注意上面的可执行程序在 win10 无法运行,因为win10检查比较严格
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 4D 5A CC CC 50 45 00 00 4C 01 01 00 75 73 65 72 MZ烫PE L user
00000010 33 32 2E 64 6C 6C 00 CC 80 00 0F 01 0B 01 4D 65 32.dll 虁 Me
00000020 73 73 61 67 65 42 6F 78 41 00 CC CC 30 00 00 00 ssageBoxA 烫0
00000030 6A 00 EB 30 CC CC CC CC 00 00 40 00 04 00 00 00 j ?烫烫 @
00000040 04 00 00 00 CC CC CC CC CC CC CC CC 04 00 CC CC 烫烫烫烫 烫
00000050 00 00 00 00 00 10 00 00 C4 00 00 00 CC CC CC CC ? 烫烫
00000060 02 00 00 00 68 0C 00 40 00 68 1E 00 40 00 6A 00 h @ h @ j
00000070 FF 15 B8 00 40 00 C3 CC 04 00 00 00 00 00 00 00 ?@ 锰
00000080 00 00 00 00 90 00 00 00 CC CC CC CC 00 00 00 00 ? 烫烫
00000090 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00
000000A0 B8 00 00 00 C4 00 00 00 00 00 00 00 C4 00 00 00 ? ? ?
000000B0 00 00 00 00 00 00 00 00 1C 00 00 00 00 00 00 00
000000C0 40 00 00 C0 @Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 4D 5A CC CC 50 45 00 00 4C 01 01 00 75 73 65 72 MZ烫PE L user
00000010 33 32 2E 64 6C 6C 00 CC 80 00 0F 01 0B 01 4D 65 32.dll 虁 Me
00000020 73 73 61 67 65 42 6F 78 41 00 CC CC 30 00 00 00 ssageBoxA 烫0
00000030 6A 00 EB 30 CC CC CC CC 00 00 40 00 04 00 00 00 j ?烫烫 @
00000040 04 00 00 00 CC CC CC CC CC CC CC CC 04 00 CC CC 烫烫烫烫 烫
00000050 00 00 00 00 00 10 00 00 C4 00 00 00 CC CC CC CC ? 烫烫
00000060 02 00 00 00 68 0C 00 40 00 68 1E 00 40 00 6A 00 h @ h @ j
00000070 FF 15 B8 00 40 00 C3 CC 04 00 00 00 00 00 00 00 ?@ 锰
00000080 00 00 00 00 90 00 00 00 CC CC CC CC 00 00 00 00 ? 烫烫
00000090 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00
000000A0 B8 00 00 00 C4 00 00 00 00 00 00 00 C4 00 00 00 ? ? ?
000000B0 00 00 00 00 00 00 00 00 1C实现目标：手写实现不大于 200 Byte大小的PE文件（又名：畸形PE/变形PE），要求MessageBox弹框显示一个字符串。实现要点：充分利用空间，在保证遵循PE结构的基础上对数据结构进行重构存放。运行环境--XP系统：XP对于畸形PE的兼容性更高。参数检查相对win7和win10更宽松编辑器--winhex：用于编写PE文件。使用winhex工具，新建200字节大小的文件文件偏移+0x00（注1），**WORD e_magic→'MZ'文件头标识：0x5A4D（注2）**文件偏移+0x3C，**LO
...(已截断)
---
来源: 看雪论坛
原文链接: https://bbs.kanxue.com/thread-286417.htm
[原创]WindowsPE文件格式入门06.手写最小PE
291 浏览
6 回复
有没有最小win10可运行的
既然变形就彻底一些，节表可以删掉
gailium
有没有最小win10可运行的
fa7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6u0L8X3E0T1L8%4S2e0L8$3k6@1N6$3q4J5k6g2)9J5c8Y4y4E0j5h3I4D9c8g2S2q4i4K6u0r3
有没有最小win10可运行的
fa7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6u0L8X3E0T1L8%4S2e0L8$3k6@1N6$3q4J5k6g2)9J5c8Y4y4E0j5h3I4D9c8g2S2q4i4K6u0r3
gailium
有没有最小win10可运行的
Win10的限制比较多
有没有最小win10可运行的
Win10的限制比较多
gailium
有没有最小win10可运行的
4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
50 45 00 00 64 86 01 00 00 00 00 00 00 00 00 00
00 00 00 00 F0 00 22 00 0B 02 0E 16 90 01 00 00
00 00 00 00 00 00 00 00 00 03 00 00 F0 01 00 00
00 00 00 40 01 00 00 00 10 00 00 00 10 00 00 00
06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00
80 03 00 00 F0 01 00 00 00 00 00 00 02 00 60 81
00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00
00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00
20 03 00 00 28 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 F0 01 00 00 10 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00
82 01 00 00 F0 01 00 00 90 01 00 00 F0 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60
58 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
3D D8 AF DC 20 00 54 00 69 00 6E 00 79 00 50 00
45 00 20 00 6F 00 6E 00 20 00 57 00 69 00 6E 00
64 00 6F 00 77 00 73 00 20 00 31 00 30 00 00 00
41 00 42 00 43 00 44 00 45 00 46 00 47 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
41 B9 40 00 24 00 4C 8D 05 F3 FE FF FF 48 8D 15
1C FF FF FF 33 C9 48 FF 25 D3 FE FF FF CC CC CC
48 03 00 00 00 00 00 00 00 00 00 00 66 03 00 00
F0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 58 03 00 00 00 00 00 00
00 00 00 00 00 00 00 00 94 02 4D 65 73 73 61 67
65 42 6F 78 57 00 55 53 45 52 33 32 2E 64 6C 6C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
有没有最小win10可运行的
4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
50 45 00 00 64 86 01 00 00 00 00 00 00 00 00 00
00 00 00 00 F0 00 22 00 0B 02 0E 16 90 01 00 00
00 00 00 00 00 00 00 00 00 03 00 00 F0 01 00 00
00 00 00 40 01 00 00 00 10 00 00 00 10 00 00 00
06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00
80 03 00 00 F0 01 00 00 00 00 00 00 02 00 60 81
00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00
00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00
20 03 00 00 28 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 F0 01 00 00 10 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00
82 01 00 00 F0 01 00 00 90 01 00 00 F0 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60
58 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
3D D8 AF DC 20 00 54 00 69 00 6E 00 79 00 50 00
45 00 20 00 6F 00 6E 00 20 00 57 00 69 00 6E 00
64 00 6F 00 77 00 73 00 20 00 31 00 30 00 00 00
41 00 42 00 43 00 44 00 45 00 46 00 47 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
41 B9 40 00 24 00 4C 8D 05 F3 FE FF FF 48 8D 15
1C FF FF FF 33 C9 48 FF 25 D3 FE FF FF CC CC CC
48 03 00 00 00 00 00 00 00 00 00 00 66 03 00 00
F0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 58 03 00 00 00 00 00 00
00 00 00 00 00 00 00 00 94 02 4D 65 73 73 61 67
65 42 6F 78 57 00 55 53 45 52 33 32 2E 64 6C 6C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
git_24725tianruoyouqing168
4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ...
$ xxd stretch.exe
00000000: 4d5a 0000 5045 0000 6486 0100 4d65 7373 MZ..PE..d...Mess
00000010: 6167 6542 6f78 5700 8000 2200 0b02 0000 ageBoxW...".....
00000020: 0201 0000 ff25 6a00 0000 0000 fc00 0000 .....%j.........
00000030: 0a00 0000 0000 0040 0100 0000 0400 0000 .......@........
00000040: 0400 0000 488d 52b8 ebda 0000 0600 0000 ....H.R.........
00000050: 0000 0000 0c01 0000 c400 0000 0000 0000 ................
00000060: 0200 6081 0000 1000 0000 0000 0010 0000 ..`.............
00000070: 0000 0000 0000 1000 0000 0000 5553 4552 ............USER
00000080: 3332 2e64 6c6c 0000 0200 0000 41b9 4000 32.dll......A.@.
00000090: 2400 ebb0 f400 0000 1800 0000 2e00 4c8d $.............L.
000000a0: 42c8 ebe8 0201 0000 9400 0000 0201 0000 B...............
000000b0: 9400 0000 4100 4200 4300 4400 4500 4600 ....A.B.C.D.E.F.
000000c0: 4700 0000 3dd8 afdc 2000 5400 6900 6e00 G...=... .T.i.n.
000000d0: 7900 5000 4500 2000 6f00 6e00 2000 5700 y.P.E. .o.n. .W.
000000e0: 6900 6e00 6400 6f00 7700 7300 2000 3100 i.n.d.o.w.s. .1.
000000f0: 3000 0000 0801 0000 0000 0000 31c9 eb9e 0...........1...
00000100: 7c00 0000 9400 0000 0a00 0000 |...........
4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ...
$ xxd stretch.exe
00000000: 4d5a 0000 5045 0000 6486 0100 4d65 7373 MZ..PE..d...Mess
00000010: 6167 6542 6f78 5700 8000 2200 0b02 0000 ageBoxW...".....
00000020: 0201 0000 ff25 6a00 0000 0000 fc00 0000 .....%j.........
00000030: 0a00 0000 0000 0040 0100 0000 0400 0000 .......@........
00000040: 0400 0000 488d 52b8 ebda 0000 0600 0000 ....H.R.........
00000050: 0000 0000 0c01 0000 c400 0000 0000 0000 ................
00000060: 0200 6081 0000 1000 0000 0000 0010 0000 ..`.............
00000070: 0000 0000 0000 1000 0000 0000 5553 4552 ............USER
00000080: 3332 2e64 6c6c 0000 0200 0000 41b9 4000 32.dll......A.@.
00000090: 2400 ebb0 f400 0000 1800 0000 2e00 4c8d $.............L.
000000a0: 42c8 ebe8 0201 0000 9400 0000 0201 0000 B...............
000000b0: 9400 0000 4100 4200 4300 4400 4500 4600 ....A.B.C.D.E.F.
000000c0: 4700 0000 3dd8 afdc 2000 5400 6900 6e00 G...=... .T.i.n.
000000d0: 7900 5000 4500 2000 6f00 6e00 2000 5700 y.P.E. .o.n. .W.
000000e0: 6900 6e00 6400 6f00 7700 7300 2000 3100 i.n.d.o.w.s. .1.
000000f0: 3000 0000 0801 0000 0000 0000 31c9 eb9e 0...........1...
00000100: 7c00 0000 9400 0000 0a00 0000 |...........