Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
1 vote
0 answers
59 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
user avatar
1 vote
1 answer
311 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
user avatar
  • 111
1 vote
3 answers
806 views

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can ...
user avatar
1 vote
3 answers
467 views

A question about the Base field in the PE Export Directory

I've been examining the PE file structure graph located here. The following is written there about the export directory: If a symbol N is exported by ordinal and name then: -Its name will be ...
user avatar
  • 111
3 votes
1 answer
173 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
user avatar
3 votes
0 answers
116 views

What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?

The relevant files for this question are here: https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip Contains a before and after DLL. This simple PHP script demonstrates the problem: <?php ...
user avatar
3 votes
1 answer
383 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
user avatar
0 votes
1 answer
941 views

How to calculate the size of a PE from headers?

What I am trying to do is calculate the size of a PE through it's headers. I am using WinDbg's Javascripting and in this case, it will mostly be for drivers. The idea is to dump a driver from memory ...
user avatar
  • 91
0 votes
2 answers
466 views

Is relocation table only used for absolute addresses?

I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me: is the relocation table used before ...
user avatar
  • 202
0 votes
0 answers
106 views

How to display processes that are running of computer in LordPE?

I tried to install some LordPE version but all when I open then no program that is running displayed in LordPE.I don't know why? I hope you guys show me the way to fix this problem.I appreciate all ...
user avatar
  • 1
-1 votes
2 answers
261 views

How to add a message box to a PE [closed]

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
user avatar
1 vote
1 answer
497 views

Can I use the Rich Header To Find out Compiler and Linker used?

I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this. Can I find the Compiler used for this program ...
user avatar
  • 723
0 votes
1 answer
239 views

PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?

SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for ...
user avatar
1 vote
1 answer
105 views

What does BindImageEx actually do?

Docs. If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
user avatar
-1 votes
1 answer
115 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
user avatar
  • 1
4 votes
1 answer
532 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
user avatar
  • 273
1 vote
1 answer
320 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
user avatar
  • 11
0 votes
1 answer
356 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
user avatar
1 vote
1 answer
156 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
user avatar
1 vote
1 answer
929 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
user avatar
0 votes
0 answers
2k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
user avatar
0 votes
1 answer
81 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
user avatar
  • 25
2 votes
2 answers
448 views

Calculating offset from push instruction in exe to string in data section

So I'm looking for some guidance on this topic. If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following: 68 7C 9D F1 01 - ...
user avatar
  • 23
0 votes
1 answer
222 views

how to get address of PE section to jump in while backdooring PE binary

EDIT: I have posted this poste at security.stackexchange I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named ....
user avatar
  • 101
0 votes
0 answers
28 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
user avatar
1 vote
0 answers
158 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
user avatar
0 votes
1 answer
82 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
user avatar
1 vote
0 answers
79 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
user avatar
0 votes
1 answer
107 views

How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?

In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims: 3 .OBJ Files (COFF) linked with LINK....
user avatar
  • 103
1 vote
0 answers
34 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
user avatar
1 vote
1 answer
3k views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
user avatar
  • 11
5 votes
3 answers
2k views

DLL starting with DCD

Today I was investigating an issue with a Microsoft DLL, mscordacwks.dll, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it ...
user avatar
11 votes
3 answers
2k views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
user avatar
  • 113
2 votes
2 answers
1k views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
user avatar
  • 175
0 votes
2 answers
1k views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
user avatar
  • 1,275
2 votes
1 answer
157 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
user avatar
  • 1,275
3 votes
1 answer
61 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
user avatar
  • 133
3 votes
1 answer
595 views

Is there a tool to reconstruct .reloc section?

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
user avatar
  • 1,740
1 vote
1 answer
626 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
user avatar
  • 133
6 votes
2 answers
259 views

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

Typically when I write a game-hacking executable after reversing a game, I go about code-caving to find where I can inject my code as need be. Well, while reversing a few such executables from someone ...
user avatar
  • 2,144
5 votes
3 answers
208 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
user avatar
0 votes
1 answer
82 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
user avatar
  • 21
1 vote
1 answer
772 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
user avatar
  • 163
2 votes
1 answer
1k views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
user avatar
1 vote
1 answer
152 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
user avatar
  • 111
7 votes
5 answers
2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
user avatar
  • 1,407
2 votes
1 answer
700 views

What's the easiest way to remove an import from the import table?

I am trying to get a DLL from an older version of Windows work on a newer version. I already patched the code to skip over the call to the missing import, but I now want to remove that ordinal import ...
user avatar
0 votes
1 answer
676 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
user avatar
  • 21
0 votes
1 answer
863 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
user avatar
  • 1,407
2 votes
1 answer
264 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
user avatar
  • 1,407