Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
199
questions
9
votes
2answers
6k views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
1
vote
2answers
2k views
Real PE32(+) entry point - is it documented anywhere?
Microsoft documentation gives WinMain() as the entry point for a Windows program, but unlike DllMain() it seems to be a pure fiction arranged by the compiler-provided startup code.
I've looked at ...
3
votes
1answer
968 views
Win64 .pdata required to be a separate COFF section?
It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping ...
3
votes
0answers
275 views
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
1
vote
2answers
1k views
Get the PE section address
I study an analysis paper about a trojan and there are the following assembly lines:
.text:004010D0 Get_PE_section_address proc near
.text:004010D0
.text:004010D0 arg_0 = dword ptr ...
1
vote
2answers
301 views
parse PE section variables
I have extracted the .rdata section from a windows executable. I would like to parse the variables contained in the section into a easily understandable format, such as:
char s[] = "hello world"
int ...
1
vote
2answers
2k views
debug a .dll compressed with pe compact
I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
1answer
2k views
Name and Ordinal table pointers in export directory are NULL although DLL exports functions
I'm trying to explore the functions exported by profapi.dll and I came across a behavior that I can't explain.
Reading about the PE binary format I gather that the export table has 3 tables (arrays):...
3
votes
1answer
669 views
Delay imported function not in export table
I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
0
votes
1answer
3k views
LoadLibrary from memory
I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory.
but when use in my code "throw" program crashing.
What's the problem?
code i use like this:
#...
1
vote
1answer
985 views
IDA Pro only shows dos stub of windows executables/libraries
When I load most windows NE/PE executables, IDA first warns me about the file being possibly packed, then it warns me with this dialog: "The input file has extra information at the end (tail < hex >...
11
votes
2answers
8k views
windows - Why is the imagebase default 0x400000?
Having stumbled upon this question (and answer): https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address on my quest for understanding Windows' PE format, I'm ...
4
votes
2answers
1k views
Import functions from executable
I've injected a DLL into an existing game.
I can import functions and variables like this:
typedef const wchar_t* (__fastcall *get_string_t)(const char*, int, const char*, int);
get_string_t ...
3
votes
3answers
3k views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
5
votes
1answer
3k views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
5
votes
1answer
6k views
Get section's names and headers for a file using C++
I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the ammount of sections, the name of sections, image section headers.
I ...
19
votes
4answers
6k views
Check if exe is 64-bit
How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
5
votes
2answers
4k views
How to hook the entry point of a DLL?
I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
3
votes
1answer
1k views
Is the magic number important
While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number".
After googling "magic number". I found that it is used to determine the file type. My question ...
1
vote
2answers
332 views
Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?
While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions:
MSVCRT.DLL
MSVCR80.DLL
MSVCR90.DLL
MSVCR100D.DLL
...
2
votes
3answers
5k views
How to figure out which imported function(s) in a virus determine its behaviour?
I want to know how to find the functions which is interesting in malware tools.
For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
1
vote
2answers
945 views
Extract driver from PE [closed]
My exact question sounds like:
Are there any tools for automated resources extraction such as driver or executable to the ready-to-go .sys or .exe/.msi ?
I googled several ways, but they haven't ...
2
votes
0answers
2k views
Unpacking Inno Setup installers with InnoExtractor?
I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn?
I get this application from here.
1
vote
1answer
806 views
How to change PE signature? [closed]
I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
5
votes
2answers
3k views
Extracting files from google chrome offline installer
I'm trying to extract the files from the Google Chrome offline installer as a reverse engineering exercise
So I tried extracting the data inside the installer PE. I tried pestudio which showed me two ...
1
vote
1answer
93 views
How can force free part of memory in process? [closed]
I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ?
ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
3
votes
1answer
403 views
What implications has the low alignment mode of a PE file?
I only found this term "low alignment mode" in the corkami wiki.
standard mode: 200 <= FileAlignment <= SectionAlignment and 1000 <= SectionAlignment
low alignment: 1 <= ...
7
votes
3answers
2k views
Reliable algorithm to extract overlay of a PE
I write a Portable Executable (PE) library that also provides finding the starting offset of the overlay (appended data to the PE that is not mapped into memory).
My algorithm finding the overlay ...
7
votes
1answer
921 views
Recovering original PE sections after Themida merges them
Visual C++ produces binaries with .code, .rdata, and .data sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run ...
3
votes
1answer
176 views
Why does packing an executable add dependencies to my executable?
Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting ...
2
votes
2answers
1k views
PE file - data directory
If you remove "data directory" from a "PE file" what will happen ?
I think loader will give an error, but I'm not sure. Please try to correct me.
0
votes
1answer
650 views
How does WinLoad.exe load the rest of the operating system?
I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for:
call 0x00408b6d <---
test al,al
je 0x0040109f
lea ...
8
votes
1answer
486 views
Loading Windows executable - unexpected data appended at beginning sections after loading in memory
Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
-2
votes
1answer
2k views
How can I locate exported functions of an EXE or DLL? [closed]
I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
5
votes
1answer
1k views
Patching PE File - Adding data
After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
5
votes
2answers
760 views
A PE packer: issues with the packed image base address
I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
6
votes
1answer
752 views
Can I set entry point at code in PE headers?
If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:
The application was unable to start correctly (0xc000007b)
But if I jmp from the ...
7
votes
3answers
4k views
Reverse engineering a VC++ video game
So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
2
votes
5answers
765 views
Question regarding sections in PE image
I have a file that among other sections has:
code
.text
.bss
And this file was not crafted manually, so I suspect.
The question is what could be the meaning of code and .text sections? As far as I ...
5
votes
2answers
2k views
Ollydbg target runs automatically
I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.)
Is ...
8
votes
2answers
8k views
How can one extract the appended data of a Portable Executable?
How do you reliably extract appended data in a Portable Executable?
13
votes
2answers
516 views
Any way to represent the file-memory relation in a Portable Executable (PE) file?
I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG...
...
5
votes
3answers
2k views
Ripping/pasting code into an executable using Olly
I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.
Originally, I had an executable that was meant to accept two command line parameters ...
4
votes
2answers
403 views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
17
votes
8answers
5k views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
29
votes
5answers
70k views
How do you reverse engineer an EXE “compiled” with PyInstaller
Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller.
In his presentation, he is creating ...
39
votes
8answers
70k views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
41
votes
3answers
22k views
Unpacking binaries in a generic way
I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
16
votes
4answers
13k views
Checking if an .exe is actually a .jar wrapped in an .exe
Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such ...
