Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
3 votes
1 answer
742 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
0 votes
0 answers
30 views

Is it possible for different dynamic memory addresses to share the same offset value?

I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory ...
0 votes
1 answer
48 views

PE FILE section read in C

I need to read PE file. I need to search word in PE file. Search is required to cover only the sections with the “executable” flag. And I need to specify the section where the word found. How can I do ...
0 votes
1 answer
375 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
12 votes
2 answers
9k views

windows - Why is the imagebase default 0x400000?

Having stumbled upon this question (and answer): https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address on my quest for understanding Windows' PE format, I'm ...
0 votes
1 answer
55 views

What is the size of a security cookie in PE file?

I know that pointer to the security cookie in Load Configuration Directory is 4 bytes long for 32-bit exe and 8 bytes long for 64-bit one (source), but what is the size of the security cookie itself? ...
1 vote
0 answers
41 views

Where can I find these compilers given in the Rich Header of a system BIOS file?

I am working on a project which deals with the BIOS file of a well known manufacturer. I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its ...
0 votes
0 answers
47 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
1 vote
1 answer
370 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
6 votes
1 answer
7k views

Get section's names and headers for a file using C++

I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the amount of sections, the name of sections, image section headers. I have ...
1 vote
0 answers
37 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
3 votes
1 answer
1k views

What conditions can create the "Not a Valid Win32 Application" error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
1 vote
1 answer
81 views

Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
0 votes
0 answers
66 views

What does the "Hint" entry in the PE import section mean?

In a ctf there was a rev PE challenge where it appeared in the deassembly as if the programm was calling functions from the ADVAPI32 but instead called some different code because the import table was ...
0 votes
0 answers
51 views

How to locate executable section

How to locate executable section in PE file? Is there any of typical way to locate executable section in any PE file?
1 vote
2 answers
97 views

How do I find where in the code a particular Windows Resource is used?

I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
2 votes
1 answer
457 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
5 votes
3 answers
2k views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
0 votes
0 answers
74 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
-1 votes
2 answers
134 views

Parse offset to PE struct

Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example: I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
1 vote
1 answer
327 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
0 votes
2 answers
202 views

What is the data on the start of .rdata segment?

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment. Filename: C:/cygwin64/bin/xkbcomp.exe Bytes: 70 D3 FD FF ...
0 votes
1 answer
471 views

How to check for a valid PE file?

How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
7 votes
2 answers
15k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
0 votes
2 answers
338 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
-1 votes
1 answer
96 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, ...
1 vote
1 answer
273 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
0 votes
1 answer
82 views

What is imagebase word means used in Lena151 RE tutorial?

In part 3 of lena RE tutorial, i see a word : imagebase Can anyone tell me more about this and better meaning of this word?
7 votes
3 answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters and ...
1 vote
1 answer
144 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
18 votes
8 answers
7k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
1 vote
1 answer
302 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0 votes
1 answer
102 views

Why a single "nop" crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
1 vote
0 answers
121 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
0 votes
0 answers
2k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
0 votes
2 answers
57 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
1 vote
2 answers
135 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
0 votes
1 answer
58 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
9 votes
2 answers
10k views

PE .rdata section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
0 votes
1 answer
639 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0 votes
0 answers
42 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0 votes
2 answers
255 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
8 votes
3 answers
9k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
1 vote
2 answers
2k views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
0 votes
1 answer
100 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
4 votes
3 answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
1 vote
1 answer
141 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
1 vote
1 answer
43 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1 vote
1 answer
75 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
4 votes
2 answers
523 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...

1
2 3 4 5