Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
223
questions
3
votes
1
answer
992
views
What is an SDB file?
In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do?
./libr/...
- 1,624
1
vote
1
answer
466
views
PE DOS stub content not commands
Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?
- 258
2
votes
5
answers
11k
views
Run PE File - (Executable) From Memory
Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose.
#include &...
- 21
2
votes
1
answer
2k
views
Bypassing av signature with Hex editing
I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
- 121
6
votes
2
answers
14k
views
Import table vs Import Address Table
What's the difference between the Import Table and the Import Address Table?
- 347
4
votes
1
answer
1k
views
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
- 101
-1
votes
1
answer
219
views
where the variable and it's size are stored inside windows executabe file?
i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.
somehow i can able to find the values of variables i ...
3
votes
2
answers
1k
views
Disassembling at a memory address
I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
- 33
0
votes
1
answer
152
views
How can I tell if a virus was made by Russians? [closed]
I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary.
I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
- 723
4
votes
2
answers
726
views
Adding section. Error starting the application (0xc000007b)
I added a section to this executable
external link to download the executable it is winmine from windows xp
using cff explorer
the only modification done to the executable is adding a section
i have ...
- 141
2
votes
2
answers
254
views
Does IMAGE_FILE_SYSTEM actually means System file
I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure.
According to all specs it says that file having this set is System file. However it doesn't ...
- 789
2
votes
2
answers
1k
views
Packed PE file and weird Header
I'm new to reverse engineering, so I don't know if my question will be easy or not.
Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings :
000003d0: 0055 5058 ...
- 21
8
votes
1
answer
4k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
3
votes
3
answers
2k
views
Exports that redirects to other library
I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example:
.text:4C362BAA aEventregister db 'EventRegister',0 ;...
3
votes
1
answer
596
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,615
3
votes
1
answer
1k
views
What conditions can create the "Not a Valid Win32 Application" error message upon load?
I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.
I've tried changing ...
- 1,615
5
votes
3
answers
3k
views
Is it possible for a .exe PE file to do something without any imports at all?
All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
- 1,615
6
votes
2
answers
915
views
What PE anomalies can crash the Windows Loader or cause a file to not load?
I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
- 1,615
-2
votes
1
answer
457
views
Crack an executable in PE [closed]
So I noticed that I can write something in PE from the executable
For example if I write 1911 he tells me
[!]Cracked By RAZOR 1911
But if I write something else it will not tell me anything. What ...
1
vote
2
answers
2k
views
Can corrupted PE files be executed in some versions of Windows but not others?
I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
- 1,615
0
votes
1
answer
897
views
What steps are needed to decode a Base64 binary?
I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist.
However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "...
- 1,615
2
votes
1
answer
1k
views
Get list of functions (including non-exported functions!) in running executable
I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.
For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
- 21
10
votes
1
answer
13k
views
How .reloc Section is used in PE file?
I have read document pecoff_v83 of Microsoft. In The .reloc section part, I have read:
The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional ...
- 323
2
votes
1
answer
7k
views
Adding a new PE section for a code cave
I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
- 177
0
votes
3
answers
3k
views
PE Sections Permissions
I wanted to know which permissions each section of the following PE Sections have (windows):
.idata
.rsrc
.data
.text
.bss
.rdata
.edata
Thanks in advance, I couldn't found an answer using google. :...
2
votes
2
answers
5k
views
How to display .text section of a PE in radare2?
I used rabin2 -Sr myfilename to get the size of the .text section of myfilename.
But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
- 111
2
votes
1
answer
2k
views
PE file format: How can I find the heap memory space in a running WinNT program?
I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
- 1,615
2
votes
0
answers
111
views
Patching a variable's type in an executable file
Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int.
Now if i am able to locate this variable's location in the ...
- 29
4
votes
2
answers
3k
views
IDA Strange exception before code is executed
I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.
I get a software ...
- 583
5
votes
1
answer
4k
views
(bad) opcodes of objdump
I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I ...
- 75
0
votes
1
answer
1k
views
Adding section to PE binary using Stud_Pe
I want to be able to accurately add a section to a binary by hand, without tools.
I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
- 723
1
vote
1
answer
126
views
"SR" instead of "MZ"
I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird.
Basically it is PE file (*....
- 789
2
votes
1
answer
819
views
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.
Now I actually want to do things with a ...
- 43
0
votes
1
answer
846
views
Restoring an Infected appending virus EXE file by
I'm trying to restore a file that was infected by a virus (gaelicum or tenga)
It's an appending virus.
This is the warning I get when opening it in OllyDbg
: ---------------------------
Entry Point ...
1
vote
1
answer
718
views
Suppress IDA welcome dialog in batch mode
I try to disassemble a bunch of PE files with the free version of IDA.
However, I can't figure out how to suppress the beginning welcome message:
My batch command looks like this:
"C:\Program Files (...
- 1,227
3
votes
1
answer
4k
views
How to know if PE Header import function is being imported by Ordinal rather than by name
I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports ...
- 178
2
votes
0
answers
5k
views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
- 123
0
votes
1
answer
736
views
Malware samples to analyze with existing disassembly?
Hopefully this question isn't get marked as Duplicate, since it differs from the following question:
Where can I, as an individual, get malware samples to analyze?
I'm looking for samples (ideally ...
- 1,227
2
votes
2
answers
5k
views
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).
The problem with such a small signature ...
- 18k
1
vote
1
answer
2k
views
Resolving DLL function names using ordinals
I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)
One thing special about that library is the ordlookup folder.
It looks ...
- 153
4
votes
1
answer
269
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
2
votes
1
answer
562
views
To what points [esp+2Ch]?
I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions:
pusha (1)
pushf ...
- 23
1
vote
0
answers
116
views
Mutable parts of PE files in memory
I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
- 1,227
0
votes
1
answer
122
views
How the same executable runs on different OS and hardware types?
I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
- 124
-1
votes
2
answers
1k
views
Formatting output of objdump -sj .text filename.exe
I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use
objdump -sj .text filename.exe
the output consists of the offset, in hexadecimal ...
- 101
-1
votes
1
answer
441
views
Error: Invalid PE header machine value with pedump
I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4.
I install pedump, on my Ubuntu system using
sudo apt-get install mono-utils
When I tried running
pedump code /...
- 101
1
vote
0
answers
198
views
Modyfying PE file data section [duplicate]
I am a bit new to RE, so forgive me any weird or stupid questions.
The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
- 11
1
vote
1
answer
4k
views
How to find all functions in DLL
I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
- 133
2
votes
1
answer
1k
views
Benign Portable Executables [closed]
.
Hello, everybody!
For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great.
While there are plenty of websites where you can ...
- 426
0
votes
1
answer
332
views
Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]
Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.
I'd like ...
- 143