Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

35 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
61 views

What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?

The relevant files for this question are here: https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip Contains a before and after DLL. This simple PHP script demonstrates the problem: <?php ...
3
votes
0answers
275 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
2
votes
0answers
753 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
2
votes
0answers
103 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
2
votes
0answers
4k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
2
votes
0answers
608 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
2
votes
0answers
581 views

Debugging digitally signed executable

I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
1
vote
0answers
29 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
1
vote
1answer
69 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
0answers
22 views

Is Import Table defined as IMAGE_IMPORT_DIRECTORY?

As I am still learning about PE using "Hello World" console app compiled with FASM, I find it challenging to understand the last part -- Import Table. I refer to various posts and barely understand ...
1
vote
0answers
48 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
1
vote
0answers
40 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
126 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
1answer
194 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
1
vote
0answers
118 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
0answers
56 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
0answers
30 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
113 views

Mutable parts of PE files in memory

I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
1
vote
0answers
327 views

Reading contents of TIB/PEB

Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.
1
vote
0answers
114 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
1
vote
1answer
475 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
0answers
20 views

Determine the PE Header load location and size in Cygwin GDB

I am currently writing GDB extensions using Python, GDB, and GEF. Due to project requirements, I need to support PE binary formats. To do this I've been using Cygwin's GDB version 8.3.1-1. Note: the ...
0
votes
0answers
29 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
16 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
0answers
44 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
0
votes
0answers
49 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
0
votes
0answers
23 views

Create Custom Packers

I scanned many PE files. Some files are not recognized as packed although they are packed. These are most difficult to reverse. Can you suggest me any tutorial for creating such packers or to pack ...
0
votes
0answers
43 views

Why do these memory address offsets not add up for this PE file?

I have used Puppy (PPEE) which is a tool similar to PE Studio for initial static analysis of a PE binary. PPEE identifies a string "Root CA" which appears at what it says is 0x0007C523, however as ...
0
votes
0answers
25 views

Yara sigs based on imported functions used in code snippet

I'm looking to write a yara signature based on an interesting decoding algorithm in a family of malware, but I'm having difficulty with correlating addresses with imported functions. Specifically, I ...
0
votes
0answers
59 views

Add function to Export Address Table

I did reverse engineering through IDA Pro, but I needed to expand my function. Since there was no free space, I renamed the old function (using Hex-view) to avoid a match, created a new section (using ...
0
votes
0answers
50 views

How to display processes that are running of computer in LordPE?

I tried to install some LordPE version but all when I open then no program that is running displayed in LordPE.I don't know why? I hope you guys show me the way to fix this problem.I appreciate all ...
0
votes
1answer
225 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
0
votes
0answers
1k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
0
votes
0answers
22 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...