0

Firstly Hello,

this is my first post on this forum even though im reading alot here.

Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.

I did read alot about the PE-File Format and how virtual memory and loading exes into the memory works. Right now im just reversing/debugging a simple HelloWorld written in C++ to understand whats going on.

Im just looking at it with radare2 and dont really understand what radare does when it opens a file. I thought its like a hexeditor with additional functionality like disassembly and detecting functions and more. But when im going to address 0x0 in radare2 it doesnt match 0x0 when i look at the file in my hexeditor. More precicly radare2 does seem to set everything apart from a certain area around entry0 to be 0xff.

So my guess is that radare2 is trying to show how the file would look like if its loaded in memory with resolved tables for imported functions and stuff.

The thing is im not really sure what im supposed to google to verify this. Thats why im asking here.

If someone could give me a little bit of insight on what is going on there would make my day. ;)

Thanks in advance.

0

Windows Pe File in disk is aligned to 0x200 bytes normally
The Same File when Loaded in memory is aligned to 0x1000 normally

C:\>radare2 -q -c "iH~Al" c:\Windows\System32\calc.exe
  SectionAlignment : 0x1000
  FileAlignment : 0x200

Windows Pe File is split into sections and Each Section File Address and Load Address is given in PE Header

C:\>radare2 -q -c "iS" c:\Windows\System32\calc.exe
[Sections]
Nm Paddr       Size Vaddr      Memsz Perms Name
00 0x00000400 339456 0x01001000 339968 -r-x .text
01 0x00053200 16896 0x01054000 20480 -rw- .data
02 0x00057400 403456 0x01059000 405504 -r-- .rsrc
03 0x000b9c00 15360 0x010bc000 16384 -r-- .reloc

By Default the pe header is loaded at Imagebase

C:\>radare2 -q -c "iH~ImageBase" c:\Windows\System32\calc.exe
  ImageBase : 0x1000000

given these Data You Can Deduce the mapping

so the bytes You See at 0x400 (first Section File Address ) in a physical file can be seen at ImageBase+Vaddr of a Loaded Module (0x1000000+0x1000)

lets check some random address mapping

C:\>radare2 -q -c "s 0x1065ef0;px 10;iS." c:\Windows\System32\calc.exe
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x01065ef0  0000 1562 4f49 4949 4b46                 ...bOIIIKF
Current section
Nm Paddr       Size Vaddr      Memsz Perms Checksum          Name
00 0x00057400 403456 0x01059000 405504 -r-- .rsrc

so to check we need to see if this offset in file contains same data

> 0x1065ef0-0x1059000+0x57400
ans = 0x000642F0


E:\>git\usr\bin\xxd.exe -s 0x642f0 -l 10 c:\Windows\System32\calc.exe
000642f0: 0000 1562 4f49 4949 4b46                 ...bOIIIKF

matches

1
  • Thank you very much and sorry for replying so late. This helps me a lot especially with all these terms like "ImageBase", "vaddr" and how its connected to each other. Im not entirely sure if im supposed to use a comment to answer but anyways. ;) – takkatak Oct 7 '20 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.