c# - 为什么这段操作PE文件头的代码使用了这么奇怪的偏移值？

Question

Here's a piece of code for obtaining the time when a .NET assembly was built .注意:

const int c_LinkerTimestampOffset = 8;

及以后:

int secondsSince1970 = System.BitConverter.ToInt32(b, i + c_LinkerTimestampOffset);

此代码提取 IMAGE_FILE_HEADER structure 的 TimeDateStamp 成员存储在程序集内。结构定义如下:

typedef struct _IMAGE_FILE_HEADER {
    WORD  Machine;
    WORD  NumberOfSections;
    DWORD TimeDateStamp;
    DWORD PointerToSymbolTable;
    DWORD NumberOfSymbols;
    WORD  SizeOfOptionalHeader;
    WORD  Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

和WORD是两个字节，应该是两个字节对齐的。当我使用 Visual C++ 10 编译以下代码时:

IMAGE_FILE_HEADER header;
char* start = (char*)&header;
char* field = (char*)(&header.TimeDateStamp);
int diff = field - start;

diff 等于 4 正如我个人所料。

这是 C# 代码中的错误吗？为什么使用8的偏移值？

Answer 1

它用于跳过附加签名，因为 i 包含 NT header 的偏移量，而不是文件图像 header (参见 formal PE structure ):

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature; //<- we need to skip this
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

所以实际的总和是sizeof(WORD/* FileHeader.Machine */) + sizeof(WORD/* FileHeader.NumberOfSections */) + sizeof(DWORD/* Signature */)

底线，不是错误，只是一些跳过结构嵌套/内联的魔法。