argc = 3,argv=3073:0FD4 check_processor() return 1 check_v86() return 0 analyse du fichier 'demo32.exe' ... entete_dos.e_lfanew=128 --> Entete dos de 0 a 63 inclus, VA de 0x400000 a 0x40003f <-- e_magic=0x5a4d e_lfanew=128 --> Entete nt de 128 a 375 inclus, VA de 0x400080 a 0x400177 <-- ==== Contenu de l'entete (IMAGE_FILE_HEADER) ==== Signature: 0x00004550 Intel 386 NumberOfSections=4 TimeDateStamp=882311343 Tuesday 16 December 1997 a 17h29m03s PointeurToSymbolTable=0 NumberOfSymbols=0 SizeOfOptionalHeader=224 sizeof(struct optional_header)=224 Characteristics=459018 EXECUTABLE_IMAGE LOCAL_SYMS_STRIPPED 32BIT_MACHINE ==== Contenu de l'entete (IMAGE_OPTIONAL_HEADER) ==== Il y a 16 sections Magic=267 LinkerVersion=3.0 SizeOfCode=4608 SizeOfInitializedData=1536 SizeOfUninitializedData=0 AddressOfEntryPoint=0x1100 BaseOfCode=0x1000 BaseOfData=0x3000 ImageBase=0x400000 SectionAlignement=4096 FileAlignement=512 OperatingSystemVersion=4.0 ImageVersion=0.0 SubsystemVersion=4.0 SizeOfImage=24576 NumberOfRvaAndSizes=16 DATA_DIRECTORY[0].VirtualAddress=0 DATA_DIRECTORY[0].Size=0 DATA_DIRECTORY[1].VirtualAddress=0 DATA_DIRECTORY[1].Size=0 DATA_DIRECTORY[2].VirtualAddress=0 DATA_DIRECTORY[2].Size=0 DATA_DIRECTORY[3].VirtualAddress=0 DATA_DIRECTORY[3].Size=0 DATA_DIRECTORY[4].VirtualAddress=0 DATA_DIRECTORY[4].Size=0 DATA_DIRECTORY[5].VirtualAddress=20480 DATA_DIRECTORY[5].Size=36 DATA_DIRECTORY[6].VirtualAddress=12288 DATA_DIRECTORY[6].Size=56 DATA_DIRECTORY[7].VirtualAddress=0 DATA_DIRECTORY[7].Size=0 DATA_DIRECTORY[8].VirtualAddress=0 DATA_DIRECTORY[8].Size=0 DATA_DIRECTORY[9].VirtualAddress=0 DATA_DIRECTORY[9].Size=0 DATA_DIRECTORY[10].VirtualAddress=0 DATA_DIRECTORY[10].Size=0 DATA_DIRECTORY[11].VirtualAddress=0 DATA_DIRECTORY[11].Size=0 DATA_DIRECTORY[12].VirtualAddress=0 DATA_DIRECTORY[12].Size=0 DATA_DIRECTORY[13].VirtualAddress=0 DATA_DIRECTORY[13].Size=0 DATA_DIRECTORY[14].VirtualAddress=0 DATA_DIRECTORY[14].Size=0 DATA_DIRECTORY[15].VirtualAddress=0 DATA_DIRECTORY[15].Size=0 Nom=DIRECTORY_ENTRY_EXPORT RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_IMPORT RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_RESOURCE RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_EXCEPTION RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_SECURITY RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_BASERELOC RVA=20480 Size=36 offset=6656 Nom=DIRECTORY_ENTRY_DEBUG RVA=12288 Size=56 offset=5632 Nom=DIRECTORY_ENTRY_COPYRIGHT RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_GLOBALPTR RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_TLS RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_LOAD_CONFIG RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_BOUND_IMPORT RVA=0 Size=0 offset=0 Nom=DIRECTORY_ENTRY_IAT RVA=0 Size=0 offset=0 Nom=reserved RVA=0 Size=0 offset=0 Nom=reserved RVA=0 Size=0 offset=0 Nom=reserved RVA=0 Size=0 offset=0 taille apres relocation=16557 le_code=31DB:0004 adr_32=31db4 min_addr=4096 taille a lire de la section 0:4416 taille a lire de la section 1:400 taille a lire de la section 2:274 taille a lire de la section 3:172 chargement ok! (le_code=0x31db0004) VirtualAddress=0x1000 NumberOfRelocations=14 [1] at 4149 (0x1035) Type=3 => Vreloc=0x00404004 [2] at 4161 (0x1041) Type=3 => Vreloc=0x00404000 [3] at 4172 (0x104c) Type=3 => Vreloc=0x00404004 [4] at 4184 (0x1058) Type=3 => Vreloc=0x00404000 [5] at 4198 (0x1066) Type=3 => Vreloc=0x00404000 [6] at 4204 (0x106c) Type=3 => Vreloc=0x00404000 [7] at 4217 (0x1079) Type=3 => Vreloc=0x00404000 [8] at 4227 (0x1083) Type=3 => Vreloc=0x00404004 [9] at 4233 (0x1089) Type=3 => Vreloc=0x00404004 [10] at 4246 (0x1096) Type=3 => Vreloc=0x00404004 [11] at 4360 (0x1108) Type=3 => Vreloc=0x0040400c [12] at 4389 (0x1125) Type=3 => Vreloc=0x00403058 [13] at 4402 (0x1132) Type=3 => Vreloc=0x0040400c [14] at 4096 (0x1000) Type=0 => on s'arrete relocation ok! (init=0x000017f2) point d'entree = 0x1100 apres relocation = 0x31eb4 Appel de exec32()