Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
1 vote
0 answers
28 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
user avatar
  • 10.5k
1 vote
1 answer
62 views

Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
user avatar
0 votes
0 answers
48 views

What does the "Hint" entry in the PE import section mean?

In a ctf there was a rev PE challenge where it appeared in the deassembly as if the programm was calling functions from the ADVAPI32 but instead called some different code because the import table was ...
user avatar
0 votes
0 answers
33 views

How to locate executable section

How to locate executable section in PE file? Is there any of typical way to locate executable section in any PE file?
user avatar
0 votes
0 answers
49 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
user avatar
1 vote
2 answers
72 views

How do I find where in the code a particular Windows Resource is used?

I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
user avatar
  • 111
-1 votes
2 answers
64 views

Parse offset to PE struct

Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example: I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
user avatar
0 votes
2 answers
105 views

What is the data on the start of .rdata segment?

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment. Filename: C:/cygwin64/bin/xkbcomp.exe Bytes: 70 D3 FD FF ...
user avatar
  • 13
0 votes
1 answer
228 views

How to check for a valid PE file?

How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
user avatar
0 votes
2 answers
241 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
user avatar
  • 69
2 votes
1 answer
309 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
user avatar
0 votes
1 answer
62 views

What is imagebase word means used in Lena151 RE tutorial?

In part 3 of lena RE tutorial, i see a word : imagebase Can anyone tell me more about this and better meaning of this word?
user avatar
  • 69
1 vote
1 answer
227 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
user avatar
  • 31
0 votes
1 answer
91 views

Why a single "nop" crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
user avatar
-1 votes
1 answer
89 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, ...
user avatar
0 votes
2 answers
52 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
user avatar
0 votes
1 answer
56 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
user avatar
0 votes
1 answer
443 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
user avatar
  • 105
0 votes
0 answers
41 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
user avatar
  • 1
0 votes
2 answers
189 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
user avatar
  • 105
1 vote
2 answers
1k views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
user avatar
  • 69
0 votes
1 answer
82 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
user avatar
1 vote
2 answers
112 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
user avatar
  • 11
1 vote
1 answer
87 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
user avatar
  • 11
1 vote
1 answer
40 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
user avatar
1 vote
1 answer
134 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
user avatar
1 vote
1 answer
72 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
user avatar
  • 1,407
4 votes
2 answers
412 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
user avatar
2 votes
1 answer
109 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
user avatar
2 votes
1 answer
90 views

PE - IAT resolve mechanism

I'm trying to understand how Windows is resolving functions with the IAT. I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
user avatar
  • 619
2 votes
1 answer
79 views

How to find "RawAddress" of a "VirtualAddress"?

I'm trying to parse a PE file manually as below: 1 ### DOS Header 2 3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 4 00000010: b800 0000 0000 0000 4000 0000 ...
user avatar
-1 votes
1 answer
87 views

Why I get 0xc00000005?

I'm trying to use RunPE technique (For learning). First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run. Then, I tried to use it on Windows 7 ...
user avatar
  • 83
0 votes
0 answers
53 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
user avatar
  • 135
0 votes
0 answers
44 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
user avatar
0 votes
2 answers
1k views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
user avatar
  • 451
1 vote
1 answer
282 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
user avatar
1 vote
2 answers
91 views

"unknown publisher" after adding new PE section

I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
user avatar
  • 31
0 votes
0 answers
85 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
user avatar
  • 1,615
1 vote
1 answer
107 views

Why are relocation tables needed?

I understand that the relocation table exists for when an image isn't loaded at its preferred address, but if an image isn't loaded at its preferred address, doesn't everything need to be relocated ...
user avatar
1 vote
0 answers
35 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
user avatar
-1 votes
1 answer
435 views

Best way to find the entropy of an EXE file?

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.
user avatar
1 vote
1 answer
240 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
user avatar
2 votes
1 answer
307 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
user avatar
0 votes
1 answer
67 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
user avatar
1 vote
0 answers
110 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
user avatar
  • 11
2 votes
3 answers
281 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
user avatar
  • 21
1 vote
1 answer
109 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
user avatar
2 votes
2 answers
155 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
user avatar
  • 123
0 votes
0 answers
28 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
user avatar
0 votes
3 answers
163 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
user avatar

1
2 3 4 5