Reverse Engineering Beta

Questions tagged [pe]

Ask Question

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

168 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
1answer
593 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
7
votes
1answer
471 views

Loading Windows executable - unexpected data appended at beginning sections after loading in memory

Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
-2
votes
1answer
2k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
2
votes
1answer
879 views

Patching PE File - Adding data

After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
5
votes
1answer
699 views

A PE packer: issues with the packed image base address

I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
6
votes
1answer
644 views

Can I set entry point at code in PE headers?

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error: The application was unable to start correctly (0xc000007b) But if I jmp from the ...
7
votes
3answers
3k views

Reverse engineering a VC++ video game

So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
2
votes
5answers
717 views

Question regarding sections in PE image

I have a file that among other sections has: code .text .bss And this file was not crafted manually, so I suspect. The question is what could be the meaning of code and .text sections? As far as I ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
7
votes
2answers
7k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
13
votes
2answers
492 views

Any way to represent the file-memory relation in a Portable Executable (PE) file?

I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG... ...
5
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters ...
4
votes
2answers
373 views

Why does an executable give an error when opened in $tool?

I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
16
votes
8answers
4k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
24
votes
5answers
51k views

How do you reverse engineer an EXE “compiled” with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...
38
votes
7answers
65k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
40
votes
3answers
19k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
15
votes
4answers
12k views

Checking if an .exe is actually a .jar wrapped in an .exe

Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth. Would it be possible to tell, given just the .exe, if it was generated using one such ...

1 2 3 4