PE 参考资料&工具

2026-06-25 08:21:56 活动专题

dumpbin:命令行工具,可以输出PE信息。

下载地址:安装vs2022 IDE时自带。

基础用法:点击开始(桌面左下角的win图标) → 找到visual studio 2022文件夹 → 展开 → 点击Developer Command Prompt for vs 2022 → 输入如下指令:

dumpbin /headers "C:\Windows\System32\notepad.exe"

输出如下:

Microsoft (R) COFF/PE Dumper Version 14.42.34435.0

Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file C:\Windows\System32\notepad.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES

8664 machine (x64)

7 number of sections

6DF9F3AD time date stamp

0 file pointer to symbol table

0 number of symbols

F0 size of optional header

22 characteristics

Executable

Application can handle large (>2GB) addresses

...