Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
27
questions
43
votes
3
answers
28k
views
Unpacking binaries in a generic way
I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
- 3,228
42
votes
8
answers
81k
views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
- 917
9
votes
3
answers
10k
views
How can one extract the appended data of a Portable Executable?
How do you reliably extract appended data in a Portable Executable?
- 6,694
7
votes
1
answer
1k
views
Patching PE File - Adding data
After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
- 73
5
votes
1
answer
4k
views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
- 181
5
votes
2
answers
485
views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
- 325
2
votes
2
answers
192
views
How can I extract *.c file hidden in an executable file (SkiFree)
I am a person interested of old games (MS DOS and 16 bit Windows only) and programming. In 2020, I saw an article about hacking SkiFree somewhere on the internet and soon as I followed the ...
- 31
40
votes
5
answers
132k
views
How do you reverse engineer an EXE "compiled" with PyInstaller
Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller.
In his presentation, he is creating ...
- 7,562
20
votes
10
answers
8k
views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
- 373
18
votes
4
answers
15k
views
Checking if an .exe is actually a .jar wrapped in an .exe
Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such ...
- 917
10
votes
2
answers
13k
views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
- 103
8
votes
1
answer
5k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
7
votes
2
answers
5k
views
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just ...
- 668
4
votes
2
answers
1k
views
How can I get xrefs to class member variables in IDA?
I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.
I want to know how I can get a list of all references to a given class member ...
- 315
4
votes
1
answer
322
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
3
votes
1
answer
810
views
Delay imported function not in export table
I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
- 67
3
votes
3
answers
4k
views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
- 51
3
votes
1
answer
2k
views
What is an SDB file?
In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do?
./libr/...
- 1,779
3
votes
1
answer
2k
views
Is the magic number important
While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number".
After googling "magic number". I found that it is used to determine the file type. My question ...
- 135
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,860
2
votes
2
answers
3k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 79
2
votes
1
answer
1k
views
Benign Portable Executables [closed]
.
Hello, everybody!
For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great.
While there are plenty of websites where you can ...
- 426
2
votes
2
answers
11k
views
Packed PE-file, where to start?
I'm new to reverse engineering, so maybe it's an easy question but not for me).
I've got .exe file which is somehow packed.
When I open it with IDA, I got warning that file was packed or modified, and ...
- 23
2
votes
1
answer
263
views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
- 395
1
vote
1
answer
183
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
- 39
0
votes
1
answer
661
views
Dumpbin: Correlating thunk jumps in .reloc to disassembly
I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
- 368
0
votes
3
answers
295
views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
- 518