请来看看,我从exe文件中读取了一段字节,我知道它是IMAGE_NT_HEADERS结构,就用BinaryFormatter()反序列化,结果出错,

Question

不可以的，因为 C# 的 序列化是有格式头的。
不是纯粹的 二进制。
使用 Marshal。

Answer 1

怎么用Marshal转呀,能不能给个列子,让我长长见识

Answer 2

封装和转换可以参考这个
http://www.cr173.com/html/11930_1.html至于那个结构体最终翻译是
[System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
public struct IMAGE_NT_HEADERS32 {
    
    /// DWORD->unsigned int
    public uint Signature;
    
    /// IMAGE_FILE_HEADER->_IMAGE_FILE_HEADER
    public IMAGE_FILE_HEADER FileHeader;
    
    /// IMAGE_OPTIONAL_HEADER->IMAGE_OPTIONAL_HEADER32->_IMAGE_OPTIONAL_HEADER
    public IMAGE_OPTIONAL_HEADER32 OptionalHeader;
}[System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
public struct IMAGE_FILE_HEADER {
    
    /// WORD->unsigned short
    public ushort Machine;
    
    /// WORD->unsigned short
    public ushort NumberOfSections;
    
    /// DWORD->unsigned int
    public uint TimeDateStamp;
    
    /// DWORD->unsigned int
    public uint PointerToSymbolTable;
    
    /// DWORD->unsigned int
    public uint NumberOfSymbols;
    
    /// WORD->unsigned short
    public ushort SizeOfOptionalHeader;
    
    /// WORD->unsigned short
    public ushort Characteristics;
}[System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
public struct IMAGE_OPTIONAL_HEADER32 {
    
    /// WORD->unsigned short
    public ushort Magic;
    
    /// BYTE->unsigned char
    public byte MajorLinkerVersion;
    
    /// BYTE->unsigned char
    public byte MinorLinkerVersion;
    
    /// DWORD->unsigned int
    public uint SizeOfCode;
    
    /// DWORD->unsigned int
    public uint SizeOfInitializedData;
    
    /// DWORD->unsigned int
    public uint SizeOfUninitializedData;
    
    /// DWORD->unsigned int
    public uint AddressOfEntryPoint;
    
    /// DWORD->unsigned int
    public uint BaseOfCode;
    
    /// DWORD->unsigned int
    public uint BaseOfData;
    
    /// DWORD->unsigned int
    public uint ImageBase;
    
    /// DWORD->unsigned int
    public uint SectionAlignment;
    
    /// DWORD->unsigned int
    public uint FileAlignment;
    
    /// WORD->unsigned short
    public ushort MajorOperatingSystemVersion;
    
    /// WORD->unsigned short
    public ushort MinorOperatingSystemVersion;
    
    /// WORD->unsigned short
    public ushort MajorImageVersion;
    
    /// WORD->unsigned short
    public ushort MinorImageVersion;
    
    /// WORD->unsigned short
    public ushort MajorSubsystemVersion;
    
    /// WORD->unsigned short
    public ushort MinorSubsystemVersion;
    
    /// DWORD->unsigned int
    public uint Win32VersionValue;
    
    /// DWORD->unsigned int
    public uint SizeOfImage;
    
    /// DWORD->unsigned int
    public uint SizeOfHeaders;
    
    /// DWORD->unsigned int
    public uint CheckSum;
    
    /// WORD->unsigned short
    public ushort Subsystem;
    
    /// WORD->unsigned short
    public ushort DllCharacteristics;
    
    /// DWORD->unsigned int
    public uint SizeOfStackReserve;
    
    /// DWORD->unsigned int
    public uint SizeOfStackCommit;
    
    /// DWORD->unsigned int
    public uint SizeOfHeapReserve;
    
    /// DWORD->unsigned int
    public uint SizeOfHeapCommit;
    
    /// DWORD->unsigned int
    public uint LoaderFlags;
    
    /// DWORD->unsigned int
    public uint NumberOfRvaAndSizes;
    
    /// IMAGE_DATA_DIRECTORY[16]
    [System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.ByValArray, SizeConst=16, ArraySubType=System.Runtime.InteropServices.UnmanagedType.Struct)]
    public IMAGE_DATA_DIRECTORY[] DataDirectory;
}[System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
public struct IMAGE_DATA_DIRECTORY {
    
    /// DWORD->unsigned int
    public uint VirtualAddress;
    
    /// DWORD->unsigned int
    public uint Size;
}