Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

8
votes
3answers
497 views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
1
vote
1answer
32 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
2answers
41 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
1
vote
1answer
38 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
3
votes
1answer
31 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
3
votes
1answer
58 views

Is there a tool to reconstruct .reloc section?

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
1
vote
1answer
68 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my exe payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressation. I applayed relocations and imports table. When I'm ...
0
votes
0answers
58 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
6
votes
2answers
135 views

Why is it “safe” to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

Typically when I write a game-hacking executable after reversing a game, I go about code-caving to find where I can inject my code as need be. Well, while reversing a few such executables from someone ...
5
votes
3answers
144 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
0
votes
1answer
47 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
1
vote
1answer
228 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
1answer
139 views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
1
vote
1answer
102 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
3
votes
4answers
225 views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
3
votes
1answer
138 views

What's the easiest way to remove an import from the import table?

I am trying to get a DLL from an older version of Windows work on a newer version. I already patched the code to skip over the call to the missing import, but I now want to remove that ordinal import ...
0
votes
1answer
146 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
0
votes
1answer
118 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
0
votes
0answers
334 views

Extract Icons from PE file with python on Linux

I am trying to write some code to extract all icons from a PE file using PEfile on linux The PE file that gives me a challenge has more icons in the RT_ICON section then listed in the RT_GROUP_ICON ...
3
votes
1answer
88 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
4
votes
1answer
193 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
1
vote
1answer
92 views

PE DOS stub content not commands

Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?
1
vote
3answers
2k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
1
vote
1answer
393 views

Bypassing av signature with Hex editing

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
1
vote
1answer
2k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
3
votes
1answer
146 views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
-1
votes
1answer
49 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
4
votes
2answers
429 views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
0
votes
1answer
145 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
3
votes
2answers
329 views

Adding section. Error starting the application (0xc000007b)

I added a section to this executable external link to download the executable it is winmine from windows xp using cff explorer the only modification done to the executable is adding a section i have ...
2
votes
2answers
111 views

Does IMAGE_FILE_SYSTEM actually means System file

I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure. According to all specs it says that file having this set is System file. However it doesn't ...
2
votes
2answers
405 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
4
votes
1answer
744 views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
2
votes
2answers
104 views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
0
votes
0answers
80 views

OllyDbg doesn't separate memory sections

So i was casually hacking a minesweeper. I created a new section in PE file for my injected code, but as you can see in the following screenshot, ollydbg merged all original sections from PE file into ...
3
votes
1answer
138 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
2
votes
0answers
376 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
5
votes
3answers
957 views

Is it possible for a .exe PE file to do anything without any imports at all?

All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
5
votes
2answers
373 views

What PE anomalies can crash the Windows Loader or cause a file to not load?

I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
-2
votes
1answer
186 views

Crack an executable in PE [closed]

So I noticed that I can write something in PE from the executable For example if I write 1911 he tells me [!]Cracked By RAZOR 1911 But if I write something else it will not tell me anything. What ...
1
vote
2answers
368 views

Can corrupted PE files be executed in some versions of Windows but not others?

I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
0
votes
1answer
396 views

What steps are needed to decode a Base64 binary?

I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist. However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "...
1
vote
1answer
262 views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
7
votes
1answer
3k views

How .reloc Section is used in PE file?

I have read document pecoff_v83 of Microsoft. In The .reloc section part, I have read: The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional ...
2
votes
1answer
2k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
0
votes
3answers
869 views

PE Sections Permissions

I wanted to know which permissions each section of the following PE Sections have (windows): .idata .rsrc .data .text .bss .rdata .edata Thanks in advance, I couldn't found an answer using google. :...
3
votes
2answers
974 views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
2
votes
1answer
507 views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
3
votes
0answers
87 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
2
votes
2answers
890 views

IDA Strange exception before code is executed

I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before. I get a software ...