Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
3 votes
1 answer
992 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
user avatar
  • 1,624
1 vote
1 answer
466 views

PE DOS stub content not commands

Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?
user avatar
  • 258
2 votes
5 answers
11k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
user avatar
  • 21
2 votes
1 answer
2k views

Bypassing av signature with Hex editing

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
user avatar
  • 121
6 votes
2 answers
14k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
user avatar
  • 347
4 votes
1 answer
1k views

If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?

Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
user avatar
  • 101
-1 votes
1 answer
219 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
user avatar
3 votes
2 answers
1k views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
user avatar
  • 33
0 votes
1 answer
152 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
user avatar
  • 723
4 votes
2 answers
726 views

Adding section. Error starting the application (0xc000007b)

I added a section to this executable external link to download the executable it is winmine from windows xp using cff explorer the only modification done to the executable is adding a section i have ...
user avatar
2 votes
2 answers
254 views

Does IMAGE_FILE_SYSTEM actually means System file

I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure. According to all specs it says that file having this set is System file. However it doesn't ...
user avatar
  • 789
2 votes
2 answers
1k views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
user avatar
8 votes
1 answer
4k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
user avatar
3 votes
3 answers
2k views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
user avatar
3 votes
1 answer
596 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
user avatar
  • 1,615
3 votes
1 answer
1k views

What conditions can create the "Not a Valid Win32 Application" error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
user avatar
  • 1,615
5 votes
3 answers
3k views

Is it possible for a .exe PE file to do something without any imports at all?

All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
user avatar
  • 1,615
6 votes
2 answers
915 views

What PE anomalies can crash the Windows Loader or cause a file to not load?

I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
user avatar
  • 1,615
-2 votes
1 answer
457 views

Crack an executable in PE [closed]

So I noticed that I can write something in PE from the executable For example if I write 1911 he tells me [!]Cracked By RAZOR 1911 But if I write something else it will not tell me anything. What ...
user avatar
1 vote
2 answers
2k views

Can corrupted PE files be executed in some versions of Windows but not others?

I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
user avatar
  • 1,615
0 votes
1 answer
897 views

What steps are needed to decode a Base64 binary?

I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist. However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "...
user avatar
  • 1,615
2 votes
1 answer
1k views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
user avatar
  • 21
10 votes
1 answer
13k views

How .reloc Section is used in PE file?

I have read document pecoff_v83 of Microsoft. In The .reloc section part, I have read: The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional ...
user avatar
2 votes
1 answer
7k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
user avatar
  • 177
0 votes
3 answers
3k views

PE Sections Permissions

I wanted to know which permissions each section of the following PE Sections have (windows): .idata .rsrc .data .text .bss .rdata .edata Thanks in advance, I couldn't found an answer using google. :...
user avatar
2 votes
2 answers
5k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
user avatar
2 votes
1 answer
2k views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
user avatar
  • 1,615
2 votes
0 answers
111 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
user avatar
4 votes
2 answers
3k views

IDA Strange exception before code is executed

I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before. I get a software ...
user avatar
  • 583
5 votes
1 answer
4k views

(bad) opcodes of objdump

I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables. I'm checking my work by comparing my output with objdump, and I ...
user avatar
  • 75
0 votes
1 answer
1k views

Adding section to PE binary using Stud_Pe

I want to be able to accurately add a section to a binary by hand, without tools. I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
user avatar
  • 723
1 vote
1 answer
126 views

"SR" instead of "MZ"

I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird. Basically it is PE file (*....
user avatar
  • 789
2 votes
1 answer
819 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
user avatar
0 votes
1 answer
846 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
user avatar
1 vote
1 answer
718 views

Suppress IDA welcome dialog in batch mode

I try to disassemble a bunch of PE files with the free version of IDA. However, I can't figure out how to suppress the beginning welcome message: My batch command looks like this: "C:\Program Files (...
user avatar
  • 1,227
3 votes
1 answer
4k views

How to know if PE Header import function is being imported by Ordinal rather than by name

I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports ...
user avatar
  • 178
2 votes
0 answers
5k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
user avatar
0 votes
1 answer
736 views

Malware samples to analyze with existing disassembly?

Hopefully this question isn't get marked as Duplicate, since it differs from the following question: Where can I, as an individual, get malware samples to analyze? I'm looking for samples (ideally ...
user avatar
  • 1,227
2 votes
2 answers
5k views

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`). The problem with such a small signature ...
user avatar
  • 18k
1 vote
1 answer
2k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
user avatar
  • 153
4 votes
1 answer
269 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
user avatar
  • 153
2 votes
1 answer
562 views

To what points [esp+2Ch]?

I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions: pusha (1) pushf ...
user avatar
1 vote
0 answers
116 views

Mutable parts of PE files in memory

I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
user avatar
  • 1,227
0 votes
1 answer
122 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
user avatar
  • 124
-1 votes
2 answers
1k views

Formatting output of objdump -sj .text filename.exe

I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use objdump -sj .text filename.exe the output consists of the offset, in hexadecimal ...
user avatar
-1 votes
1 answer
441 views

Error: Invalid PE header machine value with pedump

I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4. I install pedump, on my Ubuntu system using sudo apt-get install mono-utils When I tried running pedump code /...
user avatar
1 vote
0 answers
198 views

Modyfying PE file data section [duplicate]

I am a bit new to RE, so forgive me any weird or stupid questions. The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
user avatar
1 vote
1 answer
4k views

How to find all functions in DLL

I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
user avatar
  • 133
2 votes
1 answer
1k views

Benign Portable Executables [closed]

. Hello, everybody! For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great. While there are plenty of websites where you can ...
user avatar
0 votes
1 answer
332 views

Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]

Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me. I'd like ...
user avatar
  • 143