Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
1
vote
0answers
33 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
114 views

Mutable parts of PE files in memory

I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
1
vote
0answers
184 views

Modyfying PE file data section [duplicate]

I am a bit new to RE, so forgive me any weird or stupid questions. The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
1
vote
0answers
344 views

Reading contents of TIB/PEB

Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.
1
vote
0answers
115 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
1
vote
2answers
339 views

Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions: MSVCRT.DLL MSVCR80.DLL MSVCR90.DLL MSVCR100D.DLL ...
1
vote
1answer
534 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
1answer
2k views

how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]

i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use i know mona.py from corelan ...
0
votes
2answers
936 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
0
votes
3answers
3k views

PE Sections Permissions

I wanted to know which permissions each section of the following PE Sections have (windows): .idata .rsrc .data .text .bss .rdata .edata Thanks in advance, I couldn't found an answer using google. :...
0
votes
1answer
673 views

Malware samples to analyze with existing disassembly?

Hopefully this question isn't get marked as Duplicate, since it differs from the following question: Where can I, as an individual, get malware samples to analyze? I'm looking for samples (ideally ...
0
votes
1answer
42 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
1answer
40 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
1answer
510 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
0
votes
1answer
695 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
0
votes
1answer
665 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
0
votes
1answer
68 views

Why a single “nop” crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
0
votes
2answers
46 views

how do i use the text like in pe files?

I extracted pe file from another pe file and I saved it. I want it execute but when I saved file computer sees it like text file. Altough my actual file starting with "4d 5a" computer sees ...
0
votes
2answers
45 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
0
votes
2answers
226 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
0
votes
1answer
93 views

How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?

In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims: 3 .OBJ Files (COFF) linked with LINK....
0
votes
1answer
73 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
0
votes
1answer
810 views

What steps are needed to decode a Base64 binary?

I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist. However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "...
0
votes
1answer
294 views

Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]

Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me. I'd like ...
0
votes
2answers
136 views

PE File can't be run - access violation, EP seems to be incorrect?

The entry point is set as 007112B0 in the header (shows up in IDA), but it always jumps me to 00B112B0 (which is inside a data segment that is basically empty). What's going on with the executable?
0
votes
1answer
44 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
0
votes
3answers
108 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
3answers
206 views

A question about the Base field in the PE Export Directory

I've been examining the PE file structure graph located here. The following is written there about the export directory: If a symbol N is exported by ordinal and name then: -Its name will be ...
0
votes
2answers
264 views

Is relocation table only used for absolute addresses?

I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me: is the relocation table used before ...
0
votes
1answer
168 views

PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?

SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for ...
0
votes
1answer
74 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
0
votes
1answer
172 views

how to get address of PE section to jump in while backdooring PE binary

EDIT: I have posted this poste at security.stackexchange I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named ....
0
votes
1answer
68 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
1answer
149 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
0
votes
1answer
771 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
0
votes
1answer
466 views

Dumpbin: Correlating thunk jumps in .reloc to disassembly

I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
0
votes
1answer
3k views

LoadLibrary from memory

I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory. but when use in my code "throw" program crashing. What's the problem? code i use like this: #...
0
votes
0answers
18 views

Windows PE File Where is the table located SEH?

I compile the file using MSVC. I am aware of the existence of the exception directory, but it is empty in my file. Although the code contains four SEH handlers. I wonder where, in this case, the ...
0
votes
0answers
29 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
1answer
41 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
1answer
49 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
0answers
30 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
25 views

Determine the PE Header load location and size in Cygwin GDB

I am currently writing GDB extensions using Python, GDB, and GEF. Due to project requirements, I need to support PE binary formats. To do this I've been using Cygwin's GDB version 8.3.1-1. Note: the ...
0
votes
0answers
34 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
22 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
0answers
72 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
0
votes
0answers
79 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
0
votes
1answer
55 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
0
votes
0answers
32 views

Create Custom Packers

I scanned many PE files. Some files are not recognized as packed although they are packed. These are most difficult to reverse. Can you suggest me any tutorial for creating such packers or to pack ...
0
votes
0answers
20 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?