Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
7
votes
3answers
1k views

Reliable algorithm to extract overlay of a PE

I write a Portable Executable (PE) library that also provides finding the starting offset of the overlay (appended data to the PE that is not mapped into memory). My algorithm finding the overlay ...
7
votes
1answer
843 views

Recovering original PE sections after Themida merges them

Visual C++ produces binaries with .code, .rdata, and .data sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run ...
3
votes
1answer
166 views

Why does packing an executable add dependencies to my executable?

Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting ...
2
votes
2answers
1k views

PE file - data directory

If you remove "data directory" from a "PE file" what will happen ? I think loader will give an error, but I'm not sure. Please try to correct me.
0
votes
1answer
589 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
7
votes
1answer
470 views

Loading Windows executable - unexpected data appended at beginning sections after loading in memory

Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
-2
votes
1answer
2k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
2
votes
1answer
869 views

Patching PE File - Adding data

After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
5
votes
1answer
698 views

A PE packer: issues with the packed image base address

I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
6
votes
1answer
637 views

Can I set entry point at code in PE headers?

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error: The application was unable to start correctly (0xc000007b) But if I jmp from the ...
7
votes
3answers
3k views

Reverse engineering a VC++ video game

So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
2
votes
5answers
711 views

Question regarding sections in PE image

I have a file that among other sections has: code .text .bss And this file was not crafted manually, so I suspect. The question is what could be the meaning of code and .text sections? As far as I ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
4
votes
2answers
373 views

Why does an executable give an error when opened in $tool?

I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
7
votes
2answers
7k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
13
votes
2answers
492 views

Any way to represent the file-memory relation in a Portable Executable (PE) file?

I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG... ...
5
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters ...
15
votes
4answers
12k views

Checking if an .exe is actually a .jar wrapped in an .exe

Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth. Would it be possible to tell, given just the .exe, if it was generated using one such ...