Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
220
questions
1
vote
1answer
976 views
How do you calculate Address Start / Size of PE Section like .rdata / .data
I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.
I started of with trying to map the memory map's addresses exactly the same ...
2
votes
0answers
679 views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
6
votes
1answer
526 views
Difference between Win7 and Win8 PE loader?
Is it known what the differences between the Window 7 and Windows 8 PE loader are?
I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
7
votes
2answers
4k views
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just ...
1
vote
1answer
1k views
How to recognize PE sections containing code?
Generally, what is the criterion by which to decide whether a PE section contains code or not?
Specifically, is a .text or .code section always considered to contain code? And what is the ...
0
votes
1answer
502 views
Dumpbin: Correlating thunk jumps in .reloc to disassembly
I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
2
votes
0answers
653 views
Debugging digitally signed executable
I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
0
votes
2answers
145 views
PE File can't be run - access violation, EP seems to be incorrect?
The entry point is set as 007112B0 in the header (shows up in IDA), but it always jumps me to 00B112B0 (which is inside a data segment that is basically empty). What's going on with the executable?
1
vote
0answers
361 views
Reading contents of TIB/PEB
Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.
0
votes
1answer
2k views
how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]
i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use
i know mona.py from corelan ...
1
vote
1answer
2k views
How to add code to Portable Executable?
I have a PE which I'd like to edit. I know I can create patches in OllyDbg and similar tools, but they all have one thing in common: I have to overwrite some present code in file. I wonder if it is ...
3
votes
1answer
204 views
How to update the injected calls' address after patching binary?
After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
2
votes
2answers
9k views
Packed PE-file, where to start?
I'm new to reverse engineering, so maybe it's an easy question but not for me).
I've got .exe file which is somehow packed.
When I open it with IDA, I got warning that file was packed or modified, and ...
2
votes
1answer
787 views
Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?
According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported.
I have an exe which ...
1
vote
1answer
1k views
Problem with entry point detection as a file offset
I have found problem with finding file offset which actually is program entry point.
In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.
...
1
vote
3answers
4k views
Python: Adding a asection to a PE file
I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
1
vote
0answers
117 views
Packers that partially decrypts contents on-the-fly
I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
4
votes
3answers
1k views
Are there exports with neither ordinal nor name or am I not understanding the PE documentation?
I don't understand one thing in the export data directory of PE files.
The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
4
votes
1answer
659 views
What is an indicator that a PE section definitely contains stuff of a specific type?
I was recently working with the Microsoft documentation about the PE and COFF specifications.
Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
0
votes
0answers
1k views
Rva to raw file offset in PE [duplicate]
What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image?
I see next cases:
RVA points into the header part ...
3
votes
2answers
701 views
Ways to define portable executable bitness 64 vs 32
I found several ways to define the bitness of PE.
IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
9
votes
2answers
9k views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
3
votes
2answers
3k views
Real PE32(+) entry point - is it documented anywhere?
Microsoft documentation gives WinMain() as the entry point for a Windows program, but unlike DllMain() it seems to be a pure fiction arranged by the compiler-provided startup code.
I've looked at ...
3
votes
1answer
1k views
Win64 .pdata required to be a separate COFF section?
It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
3
votes
0answers
289 views
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
1
vote
2answers
1k views
Get the PE section address
I study an analysis paper about a trojan and there are the following assembly lines:
.text:004010D0 Get_PE_section_address proc near
.text:004010D0
.text:004010D0 arg_0 = dword ptr ...
1
vote
2answers
360 views
parse PE section variables
I have extracted the .rdata section from a windows executable. I would like to parse the variables contained in the section into a easily understandable format, such as:
char s[] = "hello world"
int ...
1
vote
2answers
2k views
debug a .dll compressed with pe compact
I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
1answer
2k views
Name and Ordinal table pointers in export directory are NULL although DLL exports functions
I'm trying to explore the functions exported by profapi.dll and I came across a behavior that I can't explain.
Reading about the PE binary format I gather that the export table has 3 tables (arrays):...
3
votes
1answer
729 views
Delay imported function not in export table
I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
0
votes
1answer
3k views
LoadLibrary from memory
I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory.
but when use in my code "throw" program crashing.
What's the problem?
code i use like this:
#...
1
vote
1answer
1k views
IDA Pro only shows dos stub of windows executables/libraries
When I load most windows NE/PE executables, IDA first warns me about the file being possibly packed, then it warns me with this dialog: "The input file has extra information at the end (tail < hex >...
11
votes
2answers
9k views
windows - Why is the imagebase default 0x400000?
Having stumbled upon this question (and answer): https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address on my quest for understanding Windows' PE format, I'm ...
4
votes
2answers
2k views
Import functions from executable
I've injected a DLL into an existing game.
I can import functions and variables like this:
typedef const wchar_t* (__fastcall *get_string_t)(const char*, int, const char*, int);
get_string_t ...
3
votes
3answers
4k views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
5
votes
1answer
3k views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
6
votes
1answer
7k views
Get section's names and headers for a file using C++
I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the ammount of sections, the name of sections, image section headers.
I ...
20
votes
4answers
7k views
Check if exe is 64-bit
How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
5
votes
2answers
5k views
How to hook the entry point of a DLL?
I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
3
votes
1answer
2k views
Is the magic number important
While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number".
After googling "magic number". I found that it is used to determine the file type. My question ...
1
vote
2answers
346 views
Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?
While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions:
MSVCRT.DLL
MSVCR80.DLL
MSVCR90.DLL
MSVCR100D.DLL
...
2
votes
3answers
5k views
How to figure out which imported function(s) in a virus determine its behaviour?
I want to know how to find the functions which is interesting in malware tools.
For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
1
vote
2answers
1k views
Extract driver from PE [closed]
My exact question sounds like:
Are there any tools for automated resources extraction such as driver or executable to the ready-to-go .sys or .exe/.msi ?
I googled several ways, but they haven't ...
2
votes
0answers
2k views
Unpacking Inno Setup installers with InnoExtractor?
I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn?
I get this application from here.
1
vote
1answer
1k views
How to change PE signature? [closed]
I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
5
votes
2answers
4k views
Extracting files from google chrome offline installer
I'm trying to extract the files from the Google Chrome offline installer as a reverse engineering exercise
So I tried extracting the data inside the installer PE. I tried pestudio which showed me two ...
1
vote
1answer
96 views
How can force free part of memory in process? [closed]
I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ?
ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
3
votes
1answer
478 views
What implications has the low alignment mode of a PE file?
I only found this term "low alignment mode" in the corkami wiki.
standard mode: 200 <= FileAlignment <= SectionAlignment and 1000 <= SectionAlignment
low alignment: 1 <= ...
7
votes
3answers
2k views
Reliable algorithm to extract overlay of a PE
I write a Portable Executable (PE) library that also provides finding the starting offset of the overlay (appended data to the PE that is not mapped into memory).
My algorithm finding the overlay ...
7
votes
1answer
1k views
Recovering original PE sections after Themida merges them
Visual C++ produces binaries with .code, .rdata, and .data sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run ...
