Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

Retrieving the contents of PE file sections

I am trying to get the contents of the .text section of a file (notepad.exe) using the following code: #define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \ ((...
1
vote
2answers
744 views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
1
vote
1answer
448 views

PE DOS stub content not commands

Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?
1
vote
1answer
4k views

How to find all functions in DLL

I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
1
vote
1answer
866 views

What are the side effects of setting the timestamp in the PE-header to 0?

The PE-Header of Windows executables contains as its third field the "Timestamp at compile time". To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=...
1
vote
1answer
1k views

How to recognize PE sections containing code?

Generally, what is the criterion by which to decide whether a PE section contains code or not? Specifically, is a .text or .code section always considered to contain code? And what is the ...
1
vote
1answer
62 views

Name other than “.text” for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
1
vote
1answer
124 views

“SR” instead of “MZ”

I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird. Basically it is PE file (*....
1
vote
1answer
1k views

Problem with entry point detection as a file offset

I have found problem with finding file offset which actually is program entry point. In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address. ...
1
vote
2answers
1k views

Get the PE section address

I study an analysis paper about a trojan and there are the following assembly lines: .text:004010D0 Get_PE_section_address proc near .text:004010D0 .text:004010D0 arg_0 = dword ptr ...
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
1answer
949 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
1
vote
3answers
263 views

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can ...
1
vote
1answer
273 views

Can I use the Rich Header To Find out Compiler and Linker used?

I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this. Can I find the Compiler used for this program ...
1
vote
1answer
2k views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
1answer
613 views

Suppress IDA welcome dialog in batch mode

I try to disassemble a bunch of PE files with the free version of IDA. However, I can't figure out how to suppress the beginning welcome message: My batch command looks like this: "C:\Program Files (...
1
vote
2answers
2k views

Statically detect destroyed Import Segment (IAT)

I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
1
vote
3answers
3k views

Python: Adding a asection to a PE file

I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
1
vote
2answers
327 views

parse PE section variables

I have extracted the .rdata section from a windows executable. I would like to parse the variables contained in the section into a easily understandable format, such as: char s[] = "hello world" int ...
1
vote
1answer
2k views

Name and Ordinal table pointers in export directory are NULL although DLL exports functions

I'm trying to explore the functions exported by profapi.dll and I came across a behavior that I can't explain. Reading about the PE binary format I gather that the export table has 3 tables (arrays):...
1
vote
1answer
1k views

IDA Pro only shows dos stub of windows executables/libraries

When I load most windows NE/PE executables, IDA first warns me about the file being possibly packed, then it warns me with this dialog: "The input file has extra information at the end (tail < hex >...
1
vote
2answers
45 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
1
vote
1answer
98 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
2answers
53 views

“unknown publisher” after adding new PE section

I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
1
vote
1answer
51 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
1
vote
1answer
652 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
2answers
1k views

Can corrupted PE files be executed in some versions of Windows but not others?

I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
1
vote
1answer
917 views

How do you calculate Address Start / Size of PE Section like .rdata / .data

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine. I started of with trying to map the memory map's addresses exactly the same ...
1
vote
1answer
2k views

How to add code to Portable Executable?

I have a PE which I'd like to edit. I know I can create patches in OllyDbg and similar tools, but they all have one thing in common: I have to overwrite some present code in file. I wonder if it is ...
1
vote
1answer
43 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
1
vote
1answer
34 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1
vote
1answer
58 views

Why are relocation tables needed?

I understand that the relocation table exists for when an image isn't loaded at its preferred address, but if an image isn't loaded at its preferred address, doesn't everything need to be relocated ...
1
vote
2answers
69 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
1
vote
1answer
88 views

What does BindImageEx actually do?

Docs. If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
1
vote
1answer
130 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
1
vote
1answer
671 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
1
vote
1answer
136 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
1
vote
1answer
1k views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
1
vote
1answer
2k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
1
vote
2answers
1k views

Extract driver from PE [closed]

My exact question sounds like: Are there any tools for automated resources extraction such as driver or executable to the ready-to-go .sys or .exe/.msi ? I googled several ways, but they haven't ...
1
vote
1answer
93 views

How can force free part of memory in process? [closed]

I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ? ZwFreeVirtualMemory(0,(LPVOID*)&(ImageBase),&(SizeOfImage),MEM_RELEASE );
1
vote
0answers
31 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
1
vote
1answer
126 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
0answers
24 views

Is Import Table defined as IMAGE_IMPORT_DIRECTORY?

As I am still learning about PE using "Hello World" console app compiled with FASM, I find it challenging to understand the last part -- Import Table. I refer to various posts and barely understand ...
1
vote
0answers
80 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
1
vote
0answers
51 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
206 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
1answer
222 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
1
vote
0answers
128 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
0answers
67 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...