用iced_x86反汇编时如何处理exe的头文件？ 我尝试过的：

如何解决用iced_x86反汇编时如何处理exe的头文件？ 我尝试过的：

我想反汇编一个可执行文件列表，其中包含我可以自定义的指令的输出格式。作为之前的 Web 开发人员，iced-x86 使用 Node.js 似乎是一种简单的入门方法。我想用这个。

我使用的代码正是 iced-x86 文档中列出的代码： Disassemble (decode and format instructions)，虽然我是从我自己的 exe 加载 Uint8Array 并将 RIP 设置为 0x0，但我不确定应该如何决定这个值 - 它似乎是任意等效于 uint64_t exampleRip = 0x00007FFAC46ACDA4：

// iced-x86 features needed: --features "decoder nasm"
const { Decoder,DecoderOptions,Formatter,FormatterSyntax } = require("iced-x86");

/*
This code produces the following output:
00007FFAC46ACDA4 48895C2410           mov       [rsp+10h],rbx
00007FFAC46ACDA9 4889742418           mov       [rsp+18h],rsi
00007FFAC46ACDAE 55                   push      rbp
00007FFAC46ACDAF 57                   push      rdi
00007FFAC46ACDB0 4156                 push      r14
00007FFAC46ACDB2 488DAC2400FFFFFF     lea       rbp,[rsp-100h]
00007FFAC46ACDBA 4881EC00020000       sub       rsp,200h
00007FFAC46ACDC1 488B0518570A00       mov       rax,[rel 7FFA`C475`24E0h]
00007FFAC46ACDC8 4833C4               xor       rax,rsp
00007FFAC46ACDCB 488985F0000000       mov       [rbp+0F0h],rax
00007FFAC46ACDD2 4C8B052F240A00       mov       r8,[rel 7FFA`C474`F208h]
00007FFAC46ACDD9 488D05787C0400       lea       rax,[rel 7FFA`C46F`4A58h]
00007FFAC46ACDE0 33FF                 xor       edi,edi
*/

const exampleBitness = 64;
const exampleRipLo = 0xC46ACDA4;
const exampleRipHi = 0x00007FFA;
const exampleCode = new Uint8Array([
    0x48,0x89,0x5C,0x24,0x10,0x48,0x74,0x18,0x55,0x57,0x41,0x56,0x8D,0xAC,0x00,0xFF,0x81,0xEC,0x02,0x8B,0x05,0x0A,0x33,0xC4,0x85,0xF0,0x4C,0x2F,0x78,0x7C,0x04,0xFF
]);
const hexBytesColumnByteLength = 10;

const decoder = new Decoder(exampleBitness,exampleCode,DecoderOptions.None);
// You have to enable the bigint feature to get i64/u64 APIs,not all browsers support BigInt
decoder.ipLo = exampleRipLo;
decoder.ipHi = exampleRipHi;
// This decodes all bytes. There's also `decode()` which decodes the next instruction,// `decodeInstructions(count)` which decodes `count` instructions and `decodeOut(instruction)`
// which overwrites an existing instruction.
const instructions = decoder.decodeAll();

// Create a nasm formatter. It supports: Masm,Nasm,Gas (AT&T) and Intel (XED).
// There's also `FastFormatter` which uses less code (smaller wasm files).
//     const formatter = new FastFormatter();
const formatter = new Formatter(FormatterSyntax.Nasm);

// Change some options,there are many more
formatter.digitSeparator = "`";
formatter.firstOperandCharIndex = 10;

// Format the instructions
instructions.forEach(instruction => {
    const disasm = formatter.format(instruction);

    // Eg. "00007FFAC46ACDB2 488DAC2400FFFFFF     lea       rbp,[rsp-100h]"
    let line = ("0000000" + instruction.ipHi.toString(16)).substr(-8).toUpperCase() +
               ("0000000" + instruction.ipLo.toString(16)).substr(-8).toUpperCase();
    line += " ";
    const startIndex = instruction.ipLo - exampleRipLo;
    exampleCode.slice(startIndex,startIndex + instruction.length).forEach(b => {
        line += ("0" + b.toString(16)).substr(-2).toUpperCase();
    });
    for (let i = instruction.length; i < hexBytesColumnByteLength; i++)
        line += "  ";
    line += " ";
    line += disasm;

    console.log(line);
});

// Free wasm memory
instructions.forEach(instruction => instruction.free());
formatter.free();
decoder.free();

与此同时，我也在用 Ghidra 反汇编同一个文件来检查我的工作。

Ghidra 输出正确的标头反汇编：

     //
     // Headers 
     // ram:00400000-ram:004001ff
     //
     assume DF = 0x0  (Default)
     IMAGE_DOS_HEADER_00400000                       XREF[1]:     004000b4(*)  
00400000 4d 5a 90        IMAGE_DO
         00 03 00 
         00 00 04 
   00400000 4d 5a           char[2]   "MZ"                    e_magic        
   00400002 90 00           dw        90h                     e_cblp        Bytes of last page
   00400004 03 00           dw        3h                      e_cp          Pages in file
   00400006 00 00           dw        0h                      e_crlc        Relocations
   00400008 04 00           dw        4h                      e_cparhdr     Size of header in 
   0040000a 00 00           dw        0h                      e_minalloc    Minimum extra para
   0040000c ff ff           dw        FFFFh                   e_maxalloc    Maximum extra para
   0040000e 00 00           dw        0h                      e_ss          Initial (relative)
   00400010 b8 00           dw        B8h                     e_sp          Initial SP value
   00400012 00 00           dw        0h                      e_csum        Checksum
   00400014 00 00           dw        0h                      e_ip          Initial IP value
   00400016 00 00           dw        0h                      e_cs          Initial (relative)
   00400018 40 00           dw        40h                     e_lfarlc      File address of re
   0040001a 00 00           dw        0h                      e_ovno        Overlay number

虽然 iced_x86 输出以下内容，但清除未正确处理标题：

0000000000000000 4D5A                 pop       r10
0000000000000002 90                   nop
0000000000000003 0003                 add       [rbx],al
0000000000000005 0000                 add       [rax],al
0000000000000007 000400               add       [rax+rax],al
000000000000000A 0000                 add       [rax],al
000000000000000C FFFF                 (bad)
000000000000000E 0000                 add       [rax],al
0000000000000010 B800000000           mov       eax,0
0000000000000015 0000                 add       [rax],al
0000000000000017 004000               add       [rax],al
000000000000001A 0000                 add       [rax],al

我正在学习汇编；我不知道如何以与其余指令不同的方式反汇编标头数据。我该如何处理？是否有我应该使用的 iced_x86 功能？

我尝试过的：

我正在浏览documentation on the topic,and found this representation in C：

 struct DOS_Header 
 {
// short is 2 bytes,long is 4 bytes
     char signature[2] = { 'M','Z' };
     short lastsize;
     short nblocks;
     short nreloc;
     short hdrsize;
     short minalloc;
     short maxalloc;
     void *ss; // 2 byte value
     void *sp; // 2 byte value
     short checksum;
     void *ip; // 2 byte value
     void *cs; // 2 byte value
     short relocpos;
     short noverlay;
     short reserved1[4];
     short oem_id;
     short oem_info;
     short reserved2[10];
     long  e_lfanew; // Offset to the 'PE\0\0' signature relative to the beginning of the file
 }

这看起来很简单。但是我仍然不确定是否需要在 Node.js 脚本中为此编写代码，或者 iced_x86 库是否已经支持它。