Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 1562

a file format for Windows executables, object code, DLLs, and more. Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr.

3
votes
No, the data is not easily parsable. The best option is to use a disassembler (such as IDA Pro) that can create cross-references from code to data in your .rdata section. This can help you better ide …
answered Dec 10 '14 by Jason Geffner
2
votes
Section names .text and .bss are default names used by Microsoft's VC++ compiler. While CODE is used by Borland's compiler, code is not. As such, it would seem as though this PE file was created … with Microsoft VC++ and the code section was added manually by the PE file's author. However, section names can be modified to be any value up to 8 characters (and are ignored by the Windows loader), so take this with a grain of salt. …
answered Jun 27 '13 by Jason Geffner
4
votes
From https://code.google.com/p/corkami/wiki/PE#PointerToRawData -- if a section's physical start is lower than 200h (the lower limit for standard alignment), it is rounded down to 0. Thus …
answered Mar 16 '15 by Jason Geffner
3
votes
-and-only-if functions are exported by name. From the official PE-COFF documentation: The export name pointer table and the export ordinal table form two parallel arrays that are separated to …
answered Nov 18 '14 by Jason Geffner
2
votes
Yes, you can add a new section to your PE file. High-level instructions at Adding sections to PE Files and low-level instructions at Inject your code to a Portable Executable file. …
answered Jul 1 '15 by Jason Geffner
2
votes
the game rules for PE32(+) entry points? Yes, from the Microsoft PE and COFF Specification, the AddressOfEntryPoint field in the PE header is defined as "For program images, this is the starting … address will be executed after TLS callback functions (also documented in the PE/COFF documentation) if they exist, and after statically loaded DLLs' DllMain() functions. parameters passed to the …
answered Dec 28 '14 by Jason Geffner
3
votes
Yes, you could add an Export Table to the original executable, with named symbols (which you define) pointing to the addresses for those functions/globals/etc. Your DLL could then import those functi …
answered Sep 12 '14 by Jason Geffner
2
votes
profapi.dll should certainly have an Export Table. For example, here's the Export Table from profapi.dll version 6.3.9600.16384: There is an export table in .text at 0x10001000 The Export Tables (in …
answered Nov 14 '14 by Jason Geffner
15
votes
why is the default imagebase value 0x400000? From http://msdn.microsoft.com/en-us/library/ms809762.aspx -- In executables produced for Windows NT, the default image base is 0x10000. For DLL …
answered Sep 15 '14 by Jason Geffner
6
votes
As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().
answered Mar 6 '16 by Jason Geffner
5
votes
(0x20000000) The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section are marked as executable in … which to decide whether a PE section contains code or not? While the .text/.code sections will usually contain code, and a section with the IMAGE_SCN_MEM_EXECUTE flag will usually contain code, the …
answered Nov 11 '15 by Jason Geffner
2
votes
While it's possible for something to be compiled with a compiler other than MSVC and "manually" import from an MSVC DLL, it's extremely unlikely and uncommon. Chances are, yes, if you see something i …
answered Jul 29 '14 by Jason Geffner
6
votes
Given that you don't already have the .obj files, it doesn't make sense to try to generate the .obj files from the .exe and .pdb files and then reverse engineer the generated .obj files. If you were t …
answered Jul 13 '13 by Jason Geffner
5
votes
"definitely" mean that that section contains code, and the absence of this flag doesn't "definitely" mean that that section doesn't contain code: A PE file can have that flag on a non-code (data) section … and still run fine (though this is not advisable from a security perspective). A PE file can have that flag missing from an actual code section, assuming that the operating system does not have DEP …
answered Feb 28 '15 by Jason Geffner
5
votes
Does this have any side-effects? No, the Windows loader doesn't care about the timestamp in an EXE's PE header. Are there compiler/linker flags to get this automatically? No, Visual C++'s … link.exe does not have a command line switch for specifying the timestamp to use. (And Visual C++'s cl.exe doesn't apply since the PE timestamp is a linking timestamp, not a compiling timestamp.) …
answered Mar 3 '16 by Jason Geffner

15 30 50 per page