OBS 影音錄製/直播 神器 未來軟體 2080/01/19

cruiseton wrote:
但 RVA 數目與大小 : NumberOfRVAandSizes
NumberOfRVAandSizes hex value 00000010 = 16
若你把 CF0014BA 當成是 自 1970/1/1 00:00 算起的秒數, 算出來就是 2080-01-19 11:23:38
但 NumberOfRVAandSizes 緊跟的欄位是 DataDirectory 和 日期有啥關係?

1. Optional Header – field layout

cruiseton wrote:
但 Windows PE 文件裡欄位英文名稱是什麼?
根據文件
Below is the field layout for a PE32 (32-bit) and PE32+ (64-bit) file, including the fields before and after NumberOfRvaAndSizes. 跟在後面的就是 DataDirectory (可達16個)
1. Optional Header – field layout
Field
Format
Size (bytes)
PE32 Offset
PE32+ Offset
SectionAlignment DWORD (uint32) 4 0x20 0x20
FileAlignment DWORD (uint32) 4 0x24 0x24
MajorOperatingSystemVersion WORD (uint16) 2 0x28 0x28
MinorOperatingSystemVersion WORD (uint16) 2 0x2A 0x2A
MajorImageVersion WORD (uint16) 2 0x2C 0x2C
MinorImageVersion WORD (uint16) 2 0x2E 0x2E
MajorSubsystemVersion WORD (uint16) 2 0x30 0x30
MinorSubsystemVersion WORD (uint16) 2 0x32 0x32
Win32VersionValue DWORD (uint32) 4 0x34 0x34
SizeOfImage DWORD (uint32) 4 0x38 0x38
SizeOfHeaders DWORD (uint32) 4 0x3C 0x3C
CheckSum DWORD (uint32) 4 0x40 0x40
Subsystem WORD (uint16) 2 0x44 0x44
DllCharacteristics WORD (uint16) 2 0x46 0x46
SizeOfStackReserve DWORD / ULONGLONG 4 / 8 0x48 0x48
SizeOfStackCommit DWORD / ULONGLONG 4 / 8 0x4C 0x50
SizeOfHeapReserve DWORD / ULONGLONG 4 / 8 0x50 0x58
SizeOfHeapCommit DWORD / ULONGLONG 4 / 8 0x54 0x60
LoaderFlags DWORD (uint32) 4 0x58 0x68
NumberOfRvaAndSizes DWORD (uint32) 4 0x5C 0x6C
DataDirectory[0] – Export IMAGE_DATA_DIRECTORY 8 0x60 0x70
DataDirectory[1] – Import IMAGE_DATA_DIRECTORY 8 0x68 0x78
DataDirectory[2] – Resource IMAGE_DATA_DIRECTORY 8 0x70 0x80
DataDirectory[3] – Exception IMAGE_DATA_DIRECTORY 8 0x78 0x88
DataDirectory[4] – Security IMAGE_DATA_DIRECTORY 8 0x80 0x90
DataDirectory[5] – Base Relocation IMAGE_DATA_DIRECTORY 8 0x88

cruiseton wrote:
好吧, 找到 在 Windows 可攜式可執行檔 (PE) 檔案格式中，偵錯日期/時間戳記會儲存在IMAGE_DEBUG_DIRECTORY結構體內部.
所以日期時間出錯有可能:
OBS programmer 的 PC 在編譯時的日期時間不對?

IQuit wrote:
(恕刪)

寬橫渡撐 wrote:
不小心標錯了？