I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, when they are loaded into memory?

My overall goal is to understand, what a normalization process of memory dumps of specific processes could look like (as mentioned here for example).

My understanding so far:

  • Sections getting mapped to different locations
  • Sections get page-aligned
  • IAT gets updated
  • Base relocations are performed

Did I miss anything?

  • 1
    i think it talks about code that has equivalent operations what you mention are standard changes i think with normalization in that article it could mean add eax , 1 = inc eax is normalised?? as plus() or a plus() label is assigned when all equivalent instructions are met in a sequence well cant stand the legalese so just glanced around – blabb Jun 2 '16 at 17:57
  • I believe PE file format and how it works is excessively documented google.com.au/search?q=pe+file+in+memory – Vitaly Osipov Jun 3 '16 at 4:26
  • As @blabb already mentioned, i try to figure out, how the normalization process is performed. Perhaps the "basic" normalization of PE loader based changes lead to confusion. Sorry! – kn000x Jun 9 '16 at 20:30
  • 1
    the TLS section will have its index assigned – peter ferrie Jun 26 '16 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.