事例1 - PE を適当に読む

PE のパーサ書くのめんどくさいので objdump で調べた値を埋める

  /*
    0 .text         002c6510  0000000000401000  0000000000401000  00000400  2**4
                    CONTENTS, ALLOC, LOAD, READONLY, CODE
    1 .data         000000a0  00000000006c8000  00000000006c8000  002c6a00  2**4
                    CONTENTS, ALLOC, LOAD, DATA
    2 .rdata        00000998  00000000006c9000  00000000006c9000  002c6c00  2**4
                    CONTENTS, ALLOC, LOAD, READONLY, DATA
  */
  
  struct Section {
    size_t size;
    size_t vma;
    size_t off;
  };
  
  Section sections[] = {
    { 0x2c6510, 0x401000, 0x400 },
    { 0xa0, 0x6c8000, 0x2c6a00 },
    { 0x998, 0x6c9000, 0x2c6c00 },
    { 0, 0, 0 }
  };