Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
3
votes
1answer
281 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
3
votes
1answer
4k views

How to know if PE Header import function is being imported by Ordinal rather than by name

I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports ...
3
votes
1answer
181 views

Why does packing an executable add dependencies to my executable?

Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting ...
3
votes
1answer
117 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
3
votes
1answer
55 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
3
votes
2answers
652 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
3
votes
3answers
4k views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
3
votes
2answers
120 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
3
votes
1answer
208 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
3
votes
1answer
698 views

Delay imported function not in export table

I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
3
votes
1answer
434 views

What implications has the low alignment mode of a PE file?

I only found this term "low alignment mode" in the corkami wiki. standard mode: 200 <= FileAlignment <= SectionAlignment and 1000 <= SectionAlignment low alignment: 1 <= ...
3
votes
1answer
454 views

Is there a tool to reconstruct .reloc section?

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
3
votes
1answer
182 views

How to update the injected calls' address after patching binary?

After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
3
votes
0answers
81 views

What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?

The relevant files for this question are here: https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip Contains a before and after DLL. This simple PHP script demonstrates the problem: <?php ...
3
votes
1answer
867 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
3
votes
0answers
279 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
2
votes
5answers
782 views

Question regarding sections in PE image

I have a file that among other sections has: code .text .bss And this file was not crafted manually, so I suspect. The question is what could be the meaning of code and .text sections? As far as I ...
2
votes
1answer
6k views

Adding a new PE section for a code cave

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and ...
2
votes
2answers
1k views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
2
votes
5answers
9k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
2
votes
2answers
4k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
2
votes
2answers
4k views

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`). The problem with such a small signature ...
2
votes
2answers
197 views

Does IMAGE_FILE_SYSTEM actually means System file

I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure. According to all specs it says that file having this set is System file. However it doesn't ...
2
votes
3answers
5k views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
2
votes
3answers
196 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
2
votes
2answers
329 views

Calculating offset from push instruction in exe to string in data section

So I'm looking for some guidance on this topic. If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following: 68 7C 9D F1 01 - ...
2
votes
1answer
129 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
2
votes
1answer
990 views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
2
votes
1answer
230 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
2
votes
1answer
2k views

Bypassing av signature with Hex editing

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
2
votes
1answer
1k views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
2
votes
2answers
8k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
2
votes
1answer
726 views

Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?

According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported. I have an exe which ...
2
votes
2answers
2k views

PE file - data directory

If you remove "data directory" from a "PE file" what will happen ? I think loader will give an error, but I'm not sure. Please try to correct me.
2
votes
1answer
81 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
50 views

PE - IAT resolve mechanism

I'm trying to understand how Windows is resolving functions with the IAT. I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
2
votes
1answer
61 views

How to find “RawAddress” of a “VirtualAddress”?

I'm trying to parse a PE file manually as below: 1 ### DOS Header 2 3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 4 00000010: b800 0000 0000 0000 4000 0000 ...
2
votes
1answer
99 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
2
votes
1answer
311 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
2
votes
1answer
516 views

What's the easiest way to remove an import from the import table?

I am trying to get a DLL from an older version of Windows work on a newer version. I already patched the code to skip over the call to the missing import, but I now want to remove that ordinal import ...
2
votes
2answers
1k views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
2
votes
1answer
690 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
2
votes
1answer
492 views

To what points [esp+2Ch]?

I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions: pusha (1) pushf ...
2
votes
1answer
1k views

Benign Portable Executables [closed]

. Hello, everybody! For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great. While there are plenty of websites where you can ...
2
votes
1answer
99 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
2
votes
0answers
103 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
2
votes
0answers
4k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
2
votes
0answers
636 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
2
votes
0answers
618 views

Debugging digitally signed executable

I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.