Questions tagged [pe]
a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.
168
questions
0
votes
1answer
593 views
How does WinLoad.exe load the rest of the operating system?
I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for:
call 0x00408b6d <---
test al,al
je 0x0040109f
lea ...
7
votes
1answer
471 views
Loading Windows executable - unexpected data appended at beginning sections after loading in memory
Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
-2
votes
1answer
2k views
How can I locate exported functions of an EXE or DLL? [closed]
I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
2
votes
1answer
879 views
Patching PE File - Adding data
After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
5
votes
1answer
699 views
A PE packer: issues with the packed image base address
I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
6
votes
1answer
644 views
Can I set entry point at code in PE headers?
If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:
The application was unable to start correctly (0xc000007b)
But if I jmp from the ...
7
votes
3answers
3k views
Reverse engineering a VC++ video game
So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
2
votes
5answers
717 views
Question regarding sections in PE image
I have a file that among other sections has:
code
.text
.bss
And this file was not crafted manually, so I suspect.
The question is what could be the meaning of code and .text sections? As far as I ...
5
votes
2answers
2k views
Ollydbg target runs automatically
I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.)
Is ...
7
votes
2answers
7k views
How can one extract the appended data of a Portable Executable?
How do you reliably extract appended data in a Portable Executable?
13
votes
2answers
492 views
Any way to represent the file-memory relation in a Portable Executable (PE) file?
I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG...
...
5
votes
3answers
2k views
Ripping/pasting code into an executable using Olly
I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.
Originally, I had an executable that was meant to accept two command line parameters ...
4
votes
2answers
373 views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
16
votes
8answers
4k views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
24
votes
5answers
51k views
How do you reverse engineer an EXE “compiled” with PyInstaller
Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller.
In his presentation, he is creating ...
38
votes
7answers
65k views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
40
votes
3answers
19k views
Unpacking binaries in a generic way
I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
15
votes
4answers
12k views
Checking if an .exe is actually a .jar wrapped in an .exe
Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such ...