Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
-1
votes
0answers
29 views

Windows PE File Where is the table located SEH?

I compile the file using MSVC. I am aware of the existence of the exception directory, but it is empty in my file. Although the code contains four SEH handlers. I wonder where, in this case, the ...
0
votes
0answers
31 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
1
vote
1answer
44 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
1answer
71 views

Why a single “nop” crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
0
votes
1answer
49 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
2answers
46 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
0
votes
1answer
44 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
0
votes
1answer
43 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
30 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
2answers
45 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
1
vote
2answers
758 views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
0
votes
1answer
41 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
1
vote
2answers
46 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
1
vote
1answer
43 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
1
vote
1answer
34 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
2
votes
1answer
100 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
1
vote
1answer
62 views

Name other than “.text” for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
3
votes
2answers
121 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
2
votes
1answer
82 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
50 views

PE - IAT resolve mechanism

I'm trying to understand how Windows is resolving functions with the IAT. I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
2
votes
1answer
61 views

How to find “RawAddress” of a “VirtualAddress”?

I'm trying to parse a PE file manually as below: 1 ### DOS Header 2 3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 4 00000010: b800 0000 0000 0000 4000 0000 ...
0
votes
0answers
25 views

Determine the PE Header load location and size in Cygwin GDB

I am currently writing GDB extensions using Python, GDB, and GEF. Due to project requirements, I need to support PE binary formats. To do this I've been using Cygwin's GDB version 8.3.1-1. Note: the ...
-1
votes
1answer
75 views

Why I get 0xc00000005?

I'm trying to use RunPE technique (For learning). First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run. Then, I tried to use it on Windows 7 ...
0
votes
0answers
36 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
22 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
2answers
232 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
1
vote
1answer
101 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
2answers
58 views

“unknown publisher” after adding new PE section

I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
0
votes
0answers
73 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
0
votes
0answers
80 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
1
vote
1answer
58 views

Why are relocation tables needed?

I understand that the relocation table exists for when an image isn't loaded at its preferred address, but if an image isn't loaded at its preferred address, doesn't everything need to be relocated ...
1
vote
0answers
31 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
-1
votes
1answer
131 views

Best way to find the entropy of an EXE file?

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.
1
vote
1answer
127 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
2
votes
1answer
101 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
1
vote
0answers
24 views

Is Import Table defined as IMAGE_IMPORT_DIRECTORY?

As I am still learning about PE using "Hello World" console app compiled with FASM, I find it challenging to understand the last part -- Import Table. I refer to various posts and barely understand ...
0
votes
1answer
55 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
1
vote
0answers
80 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
0
votes
0answers
32 views

Create Custom Packers

I scanned many PE files. Some files are not recognized as packed although they are packed. These are most difficult to reverse. Can you suggest me any tutorial for creating such packers or to pack ...
2
votes
3answers
199 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
1
vote
1answer
51 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
1
vote
2answers
69 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
0
votes
0answers
21 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
0
votes
3answers
108 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
1
vote
0answers
51 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
209 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
3answers
267 views

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can ...
0
votes
3answers
207 views

A question about the Base field in the PE Export Directory

I've been examining the PE file structure graph located here. The following is written there about the export directory: If a symbol N is exported by ordinal and name then: -Its name will be ...
3
votes
1answer
118 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
3
votes
0answers
81 views

What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?

The relevant files for this question are here: https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip Contains a before and after DLL. This simple PHP script demonstrates the problem: <?php ...

1
2 3 4 5