when i view pe file in hexeditor value is reversing stored in it but why?
for example :
in pe file header structure 2nd record is referred to Number Of Section
that's value is 0300
but real value is 0003
that's mean for read value from pe file we must read it byte to byte from right !

有帮助吗?

解决方案

PE format is Little Endian, so the least-significant byte is first.

许可以下: CC-BY-SA归因
不隶属于 StackOverflow
scroll top