Questions tagged [pe32]
The pe32 tag has no usage guidance.
16 questions
2
votes
1
answer
262
views
Analyzing a possibly malware sample
I am trying to analyze a possible malicious sample. It's a windows executable
e3f04124e2e26f8f030f6845086875a9
Md5sum
Intel 386 or later processors and compatible processors
File 2464.exe
2464.exe: ...
- 129
1
vote
2
answers
2k
views
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The context:
For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
- 111
2
votes
1
answer
412
views
How to find "RawAddress" of a "VirtualAddress"?
I'm trying to parse a PE file manually as below:
1 ### DOS Header
2
3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
4 00000010: b800 0000 0000 0000 4000 0000 ...
- 207
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
1
vote
0
answers
44
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
0
votes
1
answer
1k
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
0
votes
0
answers
286
views
jmp to 4 byte address in shellcode
I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls MessageBoxA with some retard parameters. After successfully replacing the MessageBoxA function ...
- 101
1
vote
1
answer
483
views
I'm trying to understand the SEH mechanism
I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
- 193
2
votes
2
answers
909
views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
- 133
1
vote
0
answers
2k
views
Understand DLL function signature from ordinal
I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions.
To my surprise the DLLs don't use names to ...
- 111
2
votes
1
answer
319
views
There is something else than a "DllMain" in a module for its initialization?
All right, Actually I am manually mapping a module into a process, actually my mapper calls DllEntryPoint from standard struct IMAGE_NT_HEADERS thus IMAGE_NT_HEADERS::OptionalHeader::...
- 197
2
votes
2
answers
3k
views
.00cfg section in the PE file
What's that .00cfg section that is being added by Visual Studio 2017
to PE32+ binary files (for x64 builds)? I'm assuming it stands for
"Control Flow Guard" section. It is relatively small and mostly ...
- 1,761
2
votes
1
answer
1k
views
PDB file vs SDB file?
Radare has a format called a sdb. I asked a question here,
What is an SDB file?
The answer I got was,
These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each ...
- 1,789
3
votes
1
answer
2k
views
What is an SDB file?
In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do?
./libr/...
- 1,789
1
vote
1
answer
487
views
PE DOS stub content not commands
Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?
- 258
1
vote
1
answer
1k
views
Should the Delay Import Directory contain virtual addresses?
The Reko decompiler crashes while trying to load the PE delay import directory of a particular binary I'm looking at. For 32-bit executables, the PE spec states that the directory consists of a ...
- 1,082