Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
199
questions
0
votes
3answers
2k views
PE Sections Permissions
I wanted to know which permissions each section of the following PE Sections have (windows):
.idata
.rsrc
.data
.text
.bss
.rdata
.edata
Thanks in advance, I couldn't found an answer using google. :...
2
votes
2answers
3k views
How to display .text section of a PE in radare2?
I used rabin2 -Sr myfilename to get the size of the .text section of myfilename.
But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
2
votes
1answer
1k views
PE file format: How can I find the heap memory space in a running WinNT program?
I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
2
votes
0answers
103 views
Patching a variable's type in an executable file
Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int.
Now if i am able to locate this variable's location in the ...
4
votes
2answers
2k views
IDA Strange exception before code is executed
I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.
I get a software ...
4
votes
1answer
3k views
(bad) opcodes of objdump
I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I ...
0
votes
1answer
963 views
Adding section to PE binary using Stud_Pe
I want to be able to accurately add a section to a binary by hand, without tools.
I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
1
vote
1answer
122 views
“SR” instead of “MZ”
I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird.
Basically it is PE file (*....
2
votes
1answer
601 views
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.
Now I actually want to do things with a ...
0
votes
1answer
723 views
Restoring an Infected appending virus EXE file by
I'm trying to restore a file that was infected by a virus (gaelicum or tenga)
It's an appending virus.
This is the warning I get when opening it in OllyDbg
: ---------------------------
Entry Point ...
1
vote
1answer
561 views
Suppress IDA welcome dialog in batch mode
I try to disassemble a bunch of PE files with the free version of IDA.
However, I can't figure out how to suppress the beginning welcome message:
My batch command looks like this:
"C:\Program Files (...
2
votes
1answer
3k views
How to know if PE Header import function is being imported by Ordinal rather than by name
I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports ...
2
votes
0answers
4k views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
0
votes
1answer
589 views
Malware samples to analyze with existing disassembly?
Hopefully this question isn't get marked as Duplicate, since it differs from the following question:
Where can I, as an individual, get malware samples to analyze?
I'm looking for samples (ideally ...
1
vote
2answers
4k views
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).
The problem with such a small signature ...
1
vote
1answer
2k views
Resolving DLL function names using ordinals
I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)
One thing special about that library is the ordlookup folder.
It looks ...
4
votes
1answer
245 views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
2
votes
1answer
448 views
To what points [esp+2Ch]?
I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions:
pusha (1)
pushf ...
1
vote
0answers
113 views
Mutable parts of PE files in memory
I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
0
votes
1answer
117 views
How the same executable runs on different OS and hardware types?
I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
-1
votes
2answers
1k views
Formatting output of objdump -sj .text filename.exe
I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use
objdump -sj .text filename.exe
the output consists of the offset, in hexadecimal ...
-1
votes
1answer
334 views
Error: Invalid PE header machine value with pedump
I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4.
I install pedump, on my Ubuntu system using
sudo apt-get install mono-utils
When I tried running
pedump code /...
1
vote
0answers
172 views
Modyfying PE file data section [duplicate]
I am a bit new to RE, so forgive me any weird or stupid questions.
The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
1
vote
1answer
3k views
How to find all functions in DLL
I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
2
votes
1answer
1k views
Benign Portable Executables [closed]
.
Hello, everybody!
For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great.
While there are plenty of websites where you can ...
0
votes
1answer
271 views
Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]
Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.
I'd like ...
1
vote
1answer
1k views
Retrieving the contents of PE file sections
I am trying to get the contents of the .text section of a file (notepad.exe) using the following code:
#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \
((...
1
vote
1answer
796 views
What are the side effects of setting the timestamp in the PE-header to 0?
The PE-Header of Windows executables contains as its third field the "Timestamp at compile time". To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=...
1
vote
2answers
2k views
Statically detect destroyed Import Segment (IAT)
I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
1
vote
1answer
875 views
How do you calculate Address Start / Size of PE Section like .rdata / .data
I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.
I started of with trying to map the memory map's addresses exactly the same ...
2
votes
0answers
608 views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
6
votes
1answer
462 views
Difference between Win7 and Win8 PE loader?
Is it known what the differences between the Window 7 and Windows 8 PE loader are?
I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
7
votes
2answers
3k views
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just ...
1
vote
1answer
1k views
How to recognize PE sections containing code?
Generally, what is the criterion by which to decide whether a PE section contains code or not?
Specifically, is a .text or .code section always considered to contain code? And what is the ...
0
votes
1answer
446 views
Dumpbin: Correlating thunk jumps in .reloc to disassembly
I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
2
votes
0answers
581 views
Debugging digitally signed executable
I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
0
votes
2answers
134 views
PE File can't be run - access violation, EP seems to be incorrect?
The entry point is set as 007112B0 in the header (shows up in IDA), but it always jumps me to 00B112B0 (which is inside a data segment that is basically empty). What's going on with the executable?
1
vote
0answers
327 views
Reading contents of TIB/PEB
Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.
0
votes
1answer
2k views
how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]
i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use
i know mona.py from corelan ...
1
vote
1answer
1k views
How to add code to Portable Executable?
I have a PE which I'd like to edit. I know I can create patches in OllyDbg and similar tools, but they all have one thing in common: I have to overwrite some present code in file. I wonder if it is ...
3
votes
1answer
168 views
How to update the injected calls' address after patching binary?
After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
2
votes
2answers
8k views
Packed PE-file, where to start?
I'm new to reverse engineering, so maybe it's an easy question but not for me).
I've got .exe file which is somehow packed.
When I open it with IDA, I got warning that file was packed or modified, and ...
2
votes
1answer
667 views
Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?
According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported.
I have an exe which ...
1
vote
1answer
1k views
Problem with entry point detection as a file offset
I have found problem with finding file offset which actually is program entry point.
In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.
...
1
vote
3answers
3k views
Python: Adding a asection to a PE file
I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
1
vote
0answers
114 views
Packers that partially decrypts contents on-the-fly
I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
4
votes
2answers
1k views
Are there exports with neither ordinal nor name or am I not understanding the PE documentation?
I don't understand one thing in the export data directory of PE files.
The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and ...
4
votes
1answer
605 views
What is an indicator that a PE section definitely contains stuff of a specific type?
I was recently working with the Microsoft documentation about the PE and COFF specifications.
Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
0
votes
0answers
1k views
Rva to raw file offset in PE [duplicate]
What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image?
I see next cases:
RVA points into the header part ...
3
votes
2answers
603 views
Ways to define portable executable bitness 64 vs 32
I found several ways to define the bitness of PE.
IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
