PE文件分析器的设计与实现

PE File Parser's Design and Implementation

在windows操作系统下的可执行文件,一般采用PE文件结构,基于这样统一格式设计的可执行文件,可以通过一定的方式来进行解析。通过PE文件分析,可以让读者对任何的可执行文件都有一个全面的认识,了解任何一个可执行文件的结构,分析其代码段、数据段、导入表、链接库等等内容,以达到拆分程序、了解程序功能、捆绑木马、分析文件是否含有木马、破解程序等目的。PE分析器就是基于这样的目的设计的一款详细的解析PE文件的工具。

Executable files in the Windows operating system are basically based on the PE file structure. Executable files based on such a unified format design can be analysed through a certain way. Through such kind of analysis, one can get a comprehensive understanding of any executable files, un- derstand the structure of any executable files , analyzes its code section, the data segment, import table, link library and etc. By doing this can users depart programs, understand the program function and bind Trojan, analyse whether a file includes Trojan or decode program and so on. The PE analyzer, based on such purposes above, is a tool that can be used to analyse PE file.