Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
217
questions
-1
votes
1answer
147 views
where the variable and it's size are stored inside windows executabe file?
i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.
somehow i can able to find the values of variables i ...
3
votes
2answers
1k views
Disassembling at a memory address
I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
0
votes
1answer
149 views
How can I tell if a virus was made by Russians? [closed]
I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary.
I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
4
votes
2answers
656 views
Adding section. Error starting the application (0xc000007b)
I added a section to this executable
external link to download the executable it is winmine from windows xp
using cff explorer
the only modification done to the executable is adding a section
i have ...
2
votes
2answers
199 views
Does IMAGE_FILE_SYSTEM actually means System file
I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure.
According to all specs it says that file having this set is System file. However it doesn't ...
2
votes
2answers
1k views
Packed PE file and weird Header
I'm new to reverse engineering, so I don't know if my question will be easy or not.
Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings :
000003d0: 0055 5058 ...
6
votes
1answer
4k views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
3
votes
3answers
1k views
Exports that redirects to other library
I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example:
.text:4C362BAA aEventregister db 'EventRegister',0 ;...
3
votes
1answer
282 views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
3
votes
1answer
868 views
What conditions can create the “Not a Valid Win32 Application” error message upon load?
I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.
I've tried changing ...
5
votes
3answers
2k views
Is it possible for a .exe PE file to do something without any imports at all?
All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
5
votes
2answers
826 views
What PE anomalies can crash the Windows Loader or cause a file to not load?
I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
-2
votes
1answer
393 views
Crack an executable in PE [closed]
So I noticed that I can write something in PE from the executable
For example if I write 1911 he tells me
[!]Cracked By RAZOR 1911
But if I write something else it will not tell me anything. What ...
1
vote
2answers
1k views
Can corrupted PE files be executed in some versions of Windows but not others?
I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
0
votes
1answer
812 views
What steps are needed to decode a Base64 binary?
I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist.
However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "...
1
vote
1answer
1k views
Get list of functions (including non-exported functions!) in running executable
I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.
For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
9
votes
1answer
10k views
How .reloc Section is used in PE file?
I have read document pecoff_v83 of Microsoft. In The .reloc section part, I have read:
The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional ...
2
votes
1answer
6k views
Adding a new PE section for a code cave
I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
0
votes
3answers
3k views
PE Sections Permissions
I wanted to know which permissions each section of the following PE Sections have (windows):
.idata
.rsrc
.data
.text
.bss
.rdata
.edata
Thanks in advance, I couldn't found an answer using google. :...
2
votes
2answers
4k views
How to display .text section of a PE in radare2?
I used rabin2 -Sr myfilename to get the size of the .text section of myfilename.
But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
2
votes
1answer
1k views
PE file format: How can I find the heap memory space in a running WinNT program?
I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
2
votes
0answers
103 views
Patching a variable's type in an executable file
Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int.
Now if i am able to locate this variable's location in the ...
4
votes
2answers
2k views
IDA Strange exception before code is executed
I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.
I get a software ...
4
votes
1answer
3k views
(bad) opcodes of objdump
I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I ...
0
votes
1answer
989 views
Adding section to PE binary using Stud_Pe
I want to be able to accurately add a section to a binary by hand, without tools.
I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
1
vote
1answer
124 views
“SR” instead of “MZ”
I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird.
Basically it is PE file (*....
2
votes
1answer
692 views
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.
Now I actually want to do things with a ...
0
votes
1answer
772 views
Restoring an Infected appending virus EXE file by
I'm trying to restore a file that was infected by a virus (gaelicum or tenga)
It's an appending virus.
This is the warning I get when opening it in OllyDbg
: ---------------------------
Entry Point ...
1
vote
1answer
613 views
Suppress IDA welcome dialog in batch mode
I try to disassemble a bunch of PE files with the free version of IDA.
However, I can't figure out how to suppress the beginning welcome message:
My batch command looks like this:
"C:\Program Files (...
3
votes
1answer
4k views
How to know if PE Header import function is being imported by Ordinal rather than by name
I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports ...
2
votes
0answers
4k views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
0
votes
1answer
678 views
Malware samples to analyze with existing disassembly?
Hopefully this question isn't get marked as Duplicate, since it differs from the following question:
Where can I, as an individual, get malware samples to analyze?
I'm looking for samples (ideally ...
2
votes
2answers
4k views
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).
The problem with such a small signature ...
1
vote
1answer
2k views
Resolving DLL function names using ordinals
I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)
One thing special about that library is the ordlookup folder.
It looks ...
4
votes
1answer
253 views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
2
votes
1answer
493 views
To what points [esp+2Ch]?
I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions:
pusha (1)
pushf ...
1
vote
0answers
114 views
Mutable parts of PE files in memory
I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
0
votes
1answer
118 views
How the same executable runs on different OS and hardware types?
I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
-1
votes
2answers
1k views
Formatting output of objdump -sj .text filename.exe
I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use
objdump -sj .text filename.exe
the output consists of the offset, in hexadecimal ...
-1
votes
1answer
367 views
Error: Invalid PE header machine value with pedump
I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4.
I install pedump, on my Ubuntu system using
sudo apt-get install mono-utils
When I tried running
pedump code /...
1
vote
0answers
184 views
Modyfying PE file data section [duplicate]
I am a bit new to RE, so forgive me any weird or stupid questions.
The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
1
vote
1answer
4k views
How to find all functions in DLL
I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
2
votes
1answer
1k views
Benign Portable Executables [closed]
.
Hello, everybody!
For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great.
While there are plenty of websites where you can ...
0
votes
1answer
294 views
Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]
Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.
I'd like ...
1
vote
1answer
1k views
Retrieving the contents of PE file sections
I am trying to get the contents of the .text section of a file (notepad.exe) using the following code:
#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \
((...
1
vote
1answer
867 views
What are the side effects of setting the timestamp in the PE-header to 0?
The PE-Header of Windows executables contains as its third field the "Timestamp at compile time". To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=...
1
vote
2answers
2k views
Statically detect destroyed Import Segment (IAT)
I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
1
vote
1answer
919 views
How do you calculate Address Start / Size of PE Section like .rdata / .data
I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.
I started of with trying to map the memory map's addresses exactly the same ...
2
votes
0answers
637 views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
6
votes
1answer
497 views
Difference between Win7 and Win8 PE loader?
Is it known what the differences between the Window 7 and Windows 8 PE loader are?
I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
