Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
235
questions
1
vote
0
answers
36
views
The execution is not at AddressOfEntryPoint after patching .text section bytes
I have a shellcode and want to inject my shellcode into a PE file (a simple compiled c program that prints Hello World on the screen) . My shellcode size is 0x2a1 and the .text section of my PE file ...
0
votes
0
answers
18
views
How to find executable code in PE-file [duplicate]
Please help me to find out how to locate the start and the end of executable code in Windows PE-file.
Which adresses in header of PE can tell me to locate what I find? Thanks!
- 101
1
vote
0
answers
85
views
List of unsolved problems of reverse engineering
Decided to write out a list of still unsolved fundamental problems in the field of reverse engineering.
This means that today - there is no easy solution to these problems, or problems that can only ...
- 481
1
vote
0
answers
52
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 11
1
vote
1
answer
123
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
1
vote
0
answers
40
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 11
1
vote
0
answers
18
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 111
0
votes
0
answers
36
views
Is it possible for different dynamic memory addresses to share the same offset value?
I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory ...
- 111
0
votes
1
answer
293
views
PE FILE section read in C
I need to read PE file. I need to search word in PE file. Search is required to cover only the sections with the “executable” flag. And I need to specify the section where the word found. How can I do ...
- 9
0
votes
1
answer
97
views
What is the size of a security cookie in PE file?
I know that pointer to the security cookie in Load Configuration Directory is 4 bytes long for 32-bit exe and 8 bytes long for 64-bit one (source), but what is the size of the security cookie itself?
...
1
vote
0
answers
60
views
Where can I find these compilers given in the Rich Header of a system BIOS file?
I am working on a project which deals with the BIOS file of a well known manufacturer.
I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its ...
- 399
0
votes
0
answers
57
views
Wrong access .data segment
Preface
I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
- 1
1
vote
0
answers
43
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.6k
1
vote
1
answer
138
views
Why is Visual Studio compiling my EXE file with an entry point that is not in the file?
So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
- 11
0
votes
0
answers
96
views
What does the "Hint" entry in the PE import section mean?
In a ctf there was a rev PE challenge where it appeared in the deassembly as if the programm was calling functions from the ADVAPI32 but instead called some different code because the import table was ...
0
votes
0
answers
99
views
How to locate executable section
How to locate executable section in PE file?
Is there any of typical way to locate executable section in any PE file?
- 101
0
votes
0
answers
131
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 369
1
vote
2
answers
202
views
How do I find where in the code a particular Windows Resource is used?
I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
- 111
-1
votes
2
answers
348
views
Parse offset to PE struct
Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example:
I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
- 57
0
votes
2
answers
420
views
What is the data on the start of .rdata segment?
I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment.
Filename: C:/cygwin64/bin/xkbcomp.exe
Bytes:
70 D3 FD FF ...
- 13
0
votes
1
answer
936
views
How to check for a valid PE file?
How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
0
votes
2
answers
538
views
Why are certain functions from kernel32.dll always imported?
I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
- 69
2
votes
1
answer
708
views
Change manifest file using ResourceHacker CLI
I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI.
I have managed to extract the resources ...
- 21
0
votes
1
answer
111
views
What is imagebase word means used in Lena151 RE tutorial?
In part 3 of lena RE tutorial, i see a word : imagebase
Can anyone tell me more about this and better meaning of this word?
- 79
1
vote
1
answer
433
views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
- 31
0
votes
1
answer
110
views
Why a single "nop" crashed the game?
I hope answer to my question is not game/app specific and can be answered in communities like this.
So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
-1
votes
1
answer
134
views
PE Self Injection Not Working
I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, ...
0
votes
2
answers
65
views
how do i use the text like in pe files?
I extracted pe file from another pe file and I saved it.
I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
0
votes
1
answer
60
views
Expanding .data section at particular area
I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
- 61
0
votes
1
answer
1k
views
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
- 105
0
votes
0
answers
46
views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
- 1
0
votes
2
answers
406
views
Pe file code starting address
When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
- 105
1
vote
2
answers
2k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 69
0
votes
1
answer
127
views
IDAPython, parse IDA DB as PE file [duplicate]
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
- 39
1
vote
2
answers
171
views
Lifting exported function instructions in PE files
I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
- 11
2
votes
1
answer
258
views
Import Address Table in Process Hollowing
I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT?
We just copy ...
- 21
1
vote
1
answer
45
views
What is the role of PAGE section in windows Drivers?
I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
- 136
1
vote
1
answer
162
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
- 39
1
vote
1
answer
84
views
Name other than ".text" for the main code section
Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
- 1,508
4
votes
2
answers
721
views
How can I get xrefs to class member variables in IDA?
I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.
I want to know how I can get a list of all references to a given class member ...
- 295
2
votes
1
answer
184
views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
- 355
2
votes
1
answer
119
views
PE - IAT resolve mechanism
I'm trying to understand how Windows is resolving functions with the IAT.
I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
- 689
2
votes
1
answer
169
views
How to find "RawAddress" of a "VirtualAddress"?
I'm trying to parse a PE file manually as below:
1 ### DOS Header
2
3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
4 00000010: b800 0000 0000 0000 4000 0000 ...
- 187
-1
votes
1
answer
98
views
Why I get 0xc00000005?
I'm trying to use RunPE technique (For learning).
First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run.
Then, I tried to use it on Windows 7 ...
- 113
0
votes
0
answers
98
views
Module name in the export table of a PE image
One of the fields of the PE export table is the image name, see screenshot below for an example.
This name is part of the file, even though I can rename it to any other name after it's compiled.
My ...
- 135
0
votes
0
answers
112
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 369
1
vote
2
answers
3k
views
How to find the file address of AddressOfEntryPoint
I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0.
I ...
- 573
1
vote
1
answer
440
views
What is physical address on a pe reader?
What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
2
answers
105
views
"unknown publisher" after adding new PE section
I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
- 41
0
votes
0
answers
120
views
How is ELF symbol resolution and relocation different from PE symbol resolution?
I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
- 1,738