Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
1
vote
2answers
57 views

How do I find where in the code a particular Windows Resource is used?

I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
1
vote
1answer
159 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
5
votes
3answers
2k views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
0
votes
0answers
27 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
-1
votes
2answers
45 views

Parse offset to PE struct

Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example: I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
3
votes
1answer
1k views

What conditions can create the "Not a Valid Win32 Application" error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
0
votes
1answer
334 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
1
vote
1answer
296 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
0
votes
2answers
79 views

What is the data on the start of .rdata segment?

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment. Filename: C:/cygwin64/bin/xkbcomp.exe Bytes: 70 D3 FD FF ...
0
votes
1answer
65 views

How to check for a valid PE file?

How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
5
votes
2answers
13k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
1
vote
1answer
286 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
2answers
183 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
-1
votes
1answer
82 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, ...
1
vote
1answer
214 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
0
votes
1answer
50 views

What is imagebase word means used in Lena151 RE tutorial?

In part 3 of lena RE tutorial, i see a word : imagebase Can anyone tell me more about this and better meaning of this word?
7
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters and ...
1
vote
1answer
127 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
18
votes
8answers
6k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
1
vote
1answer
150 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
0answers
41 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
1answer
90 views

Why a single "nop" crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
1
vote
0answers
99 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
0
votes
0answers
2k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
0
votes
2answers
49 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
1
vote
2answers
92 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
0
votes
1answer
54 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
9
votes
2answers
9k views

PE .rdata section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
0
votes
1answer
256 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
36 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
2answers
98 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
8
votes
3answers
9k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
1
vote
2answers
1k views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
0
votes
1answer
64 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
4
votes
3answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
1
vote
1answer
55 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
1
vote
1answer
39 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1
vote
1answer
68 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
4
votes
2answers
297 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
2
votes
1answer
76 views

PE - IAT resolve mechanism

I'm trying to understand how Windows is resolving functions with the IAT. I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
2
votes
1answer
98 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
71 views

How to find "RawAddress" of a "VirtualAddress"?

I'm trying to parse a PE file manually as below: 1 ### DOS Header 2 3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 4 00000010: b800 0000 0000 0000 4000 0000 ...
4
votes
1answer
1k views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
0
votes
2answers
953 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
-1
votes
1answer
84 views

Why I get 0xc00000005?

I'm trying to use RunPE technique (For learning). First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run. Then, I tried to use it on Windows 7 ...
40
votes
8answers
77k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
0
votes
0answers
46 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
32 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
1
vote
1answer
211 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
145 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.

1
2 3 4 5