Questions tagged [pe]

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

Filter by
Sorted by
Tagged with
0
votes
0answers
69 views

How to display processes that are running of computer in LordPE?

I tried to install some LordPE version but all when I open then no program that is running displayed in LordPE.I don't know why? I hope you guys show me the way to fix this problem.I appreciate all ...
0
votes
1answer
260 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
0
votes
0answers
1k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
0
votes
0answers
22 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
0
votes
1answer
987 views

Adding section to PE binary using Stud_Pe

I want to be able to accurately add a section to a binary by hand, without tools. I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
0
votes
1answer
118 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
0
votes
0answers
1k views

Rva to raw file offset in PE [duplicate]

What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image? I see next cases: RVA points into the header part ...
-1
votes
1answer
75 views

Why I get 0xc00000005?

I'm trying to use RunPE technique (For learning). First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run. Then, I tried to use it on Windows 7 ...
-1
votes
2answers
142 views

How to add a message box to a PE [closed]

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
-1
votes
1answer
145 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
-1
votes
2answers
1k views

Formatting output of objdump -sj .text filename.exe

I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use objdump -sj .text filename.exe the output consists of the offset, in hexadecimal ...
-1
votes
1answer
128 views

Best way to find the entropy of an EXE file?

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.
-1
votes
1answer
93 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
-1
votes
1answer
366 views

Error: Invalid PE header machine value with pedump

I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4. I install pedump, on my Ubuntu system using sudo apt-get install mono-utils When I tried running pedump code /...
-2
votes
1answer
2k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
-2
votes
1answer
391 views

Crack an executable in PE [closed]

So I noticed that I can write something in PE from the executable For example if I write 1911 he tells me [!]Cracked By RAZOR 1911 But if I write something else it will not tell me anything. What ...

1 2 3 4
5