现状PS:有的库能加载有的库不能加载,
很简单的思路就是用PE分析工具分析了一下能加载的库和不能加载的库的区别:下面我贴一下我分析的两个你能加载的库和不能加载的库的分析结果
SDL.dll(能加载,但是编译环境未知)
File Type: DLL
FILE HEADER VALUES
1C2 machine (Unknown)
5 number of sections
48294911 time date stamp Tue May 13 00:53:53 2008
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
2102 characteristics
Executable
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
8.00 linker version
2E200 size of code
B200 size of initialized data
0 size of uninitialized data
2ED20 RVA of entry point
1000 base of code
30000 base of data
100000 image base
1000 section alignment
200 file alignment
4.00 operating system version
0.00 image version
4.10 subsystem version
0 Win32 version
3D000 size of image
400 size of headers
0 checksum
9 subsystem (Windows CE GUI)
0 DLL characteristics
10000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 loader flags
10 number of directories
347E0 [ 13DB] RVA [size] of Export Directory
344B8 [ 3C] RVA [size] of Import Directory
0 [ 0] RVA [size] of Resource Directory
........
36000 [ 290] RVA [size] of Import Address Table Directory
0 [ 0] RVA [size] of Delay Import Directory
........
SECTION HEADER #1
.text name
2E02C virtual size
1000 virtual address
2E200 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
Execute Read
SECTION HEADER #2
.rdata name 5BBB virtual size//输入输出表都放在了这里 30000 virtual address
5C00 size of raw data
2E600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
Section contains the following exports for SDL.dll
0 characteristics
4829490B time date stamp Tue May 13 00:53:47 2008
0.00 version
1 ordinal base
196 number of functions
196 number of names
SECTION HEADER #3
.data name
2F40 virtual size
36000 virtual address
600 size of raw data
34200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
Read Write
SECTION HEADER #4
.pdata name
1028 virtual size
39000 virtual address
1200 size of raw data
34800 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
SECTION HEADER #5
.reloc name
12BC virtual size
3B000 virtual address
1400 size of raw data
35A00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
Read Only
BASE RELOCATIONS #5
1000 RVA, 6C SizeOfBlock
F0 HIGHLOW
F4 HIGHLOW
F8 HIGHLOW
FC HIGHLOW
。。。。。。。
DLL.dll(能加载,编译环境已知是vs)Dump of file Dll.dll
PE signature found
File Type: DLL
FILE HEADER VALUES
1C2 machine (Unknown)
5 number of sections
4945C8DB time date stamp Sun Dec 14 19:02:51 2008
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
2102 characteristics
Executable
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
8.00 linker version
A00 size of code
1C00 size of initialized data
0 size of uninitialized data
1604 RVA of entry point
1000 base of code
2000 base of data
10000000 image base
1000 section alignment
200 file alignment
4.00 operating system version
0.00 image version
5.01 subsystem version
0 Win32 version
7000 size of image
400 size of headers
0 checksum
9 subsystem (Windows CE GUI)
0 DLL characteristics
100000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 loader flags
10 number of directories
2060 [ 72] RVA [size] of Export Directory
201C [ 28] RVA [size] of Import Directory
.......
3000 [ 8] RVA [size] of Import Address Table Directory
0 [ 0] RVA [size] of Delay Import Directory
SECTION HEADER #1
.text name
8F0 virtual size
1000 virtual address
A00 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
Execute Read
SECTION HEADER #2
.rdata name 141 virtual size
2000 virtual address
200 size of raw data
E00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
Section contains the following exports for Dll.dll 0 characteristics
4945C8DB time date stamp Sun Dec 14 19:02:51 2008
0.00 version
1 ordinal base
3 number of functions
3 number of names
COREDLL.dll //以序数调用 10003000 Import Address Table
10002044 Import Name Table
0 time date stamp
0 Index of first forwarder reference
Ordinal 36
SECTION HEADER #3
.data name
1474 virtual size
3000 virtual address
200 size of raw data
1000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
Read Write
SECTION HEADER #4
.pdata name
70 virtual size
5000 virtual address
200 size of raw data
1200 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
Function Table (5)
Begin End Excptn ExcpDat Prolog Type Fixups Function Name
SECTION HEADER #5
.reloc name
72 virtual size
6000 virtual address
200 size of raw data
1400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
Read Only
PE signature found
File Type: DLL
FILE HEADER VALUES
1C0 machine (ARM)
10 number of sections
48F82D10 time date stamp Thu Oct 16 23:13:36 2008
FC00 file pointer to symbol table
644 number of symbols
E0 size of optional header
2106 characteristics
Executable
Line numbers stripped
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
2.56 linker version
6400 size of code
1800 size of initialized data
2000 size of uninitialized data
1000 RVA of entry point
1000 base of code
8000 base of data
6B200000 image base
1000 section alignment
200 file alignment
4.00 operating system version
1.00 image version
3.00 subsystem version
0 Win32 version
1C000 size of image
600 size of headers
1DF7F checksum
9 subsystem (Windows CE GUI)
0 DLL characteristics
200000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 loader flags
10 number of directories
C000 [ 71B] RVA [size] of Export Directory
D000 [ 230] RVA [size] of Import Directory
...........
SECTION HEADER #1
.text name
6288 virtual size
1000 virtual address
6400 size of raw data
600 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
Execute Read
SECTION HEADER #2
.data name
10 virtual size
8000 virtual address
200 size of raw data
6A00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
Read Write
SECTION HEADER #3
.rdata name
724 virtual size
9000 virtual address
800 size of raw data
6C00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
SECTION HEADER #4
.bss name
1E24 virtual size
A000 virtual address
0 size of raw data
0 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000080 flags
Uninitialized Data
Read Write
SECTION HEADER #5
.edata name 71B virtual size
C000 virtual address
800 size of raw data
7400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
Read Only
Section contains the following exports for cygavutil-49.dll
0 characteristics
48F82D10 time date stamp Thu Oct 16 23:13:36 2008
0.00 version
1 ordinal base
76 number of functions
76 number of names
ordinal hint RVA name
.......
SECTION HEADER #6
.idata name 230 virtual size
D000 virtual address
400 size of raw data
7C00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
Read Write
Section contains the following imports:
COREDLL //通过函数名调用
6B20D084 Import Address Table
6B20D02C Import Name Table
0 time date stamp
0 Index of first forwarder reference