0

How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?

1
  • 3
    Hi and welcome to RE.SE. Valid in what context? You realize certain PE files that, for example, Windows 95 would have swallowed, or NT 4 or XP, will not work on latest Windows 10 or vice versa. Look for the corkami zoo of .exe file samples (many of which are PE) and you will notice that some will be considered valid even by modern Windows, while others won't (but were in older Windows versions). That is: as it stands your question is far too vague to answer meaningfully. Please edit your question and add some context.
    – 0xC0000022L
    Nov 16, 2021 at 12:04

1 Answer 1

1

The ultimate judge is the particular operating system (more precisely, its loader), i.e. the validity of PE header is always necessary to consider in this context (as wrote the 0xC0000022L in his comment). If the loader loads and launch an executable, its PE header is (from its point of view) valid, even if some fields are empty or don't correspond to the documentation.

One loader may ignore some fields (e.g. a checksum) or even adjust an incorrect value(s), the other simply refuses to load the same PE file.

So your best testing tool is the operating system itself (but not for malware, of course ;-)).

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.