How is machine code stored in the EXE file?

前端 未结 2 888
臣服心动
臣服心动 2021-01-05 00:54

My questions are as follows:

  1. How does the Portable Executable format (on Windows/Unix) relate to the x86/x64 instruction set in general?
  2. Does the PE f
2条回答
  •  暖寄归人
    2021-01-05 00:59

    The PE file format (and the ELF/COFF file formats on non-windows machines) defines a header that appears at the beginning of the file, and in this header, there is a 'Machine' code. In a PE file, the 'Machine' code is 2 bytes, and the spec defines a bunch of constants for various machines:

    0x1d3   Matsushita AM33
    0x8664  AMD x64
    0x1c0   ARM little endian   
    0x1c4   ARMv7 (or higher) Thumb mode only
    0xebc   EFI byte code   
    0x14c   Intel 386 or later processors and compatible processors 
    0x200   Intel Itanium processor family  
    0x9041  Mitsubishi M32R little endian   
    0x266   MIPS16  
    0x366   MIPS with FPU
    0x466   MIPS16 with FPU 
    0x1f0   Power PC little endian  
    0x1f1   Power PC with floating point support    
    0x166   MIPS little endian  
    0x1a2   Hitachi SH3 
    0x1a3   Hitachi SH3 DSP 
    0x1a6   Hitachi SH4 
    0x1a8   Hitachi SH5     
    0x1c2   ARM or Thumb (“interworking”)   
    0x169   MIPS little endian WCE v2   
    

    Then, within the PE (or ELF) file there are one or more 'Code' sections that contain (binary) machine code. That code is loaded into memory and executed directly by the CPU. The OS or dynamic linker/loader (which does the actual loading) knows what machine it is running on, so it checks the 'Machine' code in the header to make sure it matches before attempting to load and execute the code. If it doesn't match, the executable will be rejected, as it can't be run.

提交回复
热议问题