17
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 8,919
14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
12
votes
Accepted
Is it possible for a .exe PE file to do something without any imports at all?
Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level.
I can think of four ...
- 11.7k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 8,919
9
votes
Import table vs Import Address Table
First, beside “yours” two tables, I introduce a third one, the Import Lookup Table.
Side by side with the Import Address Table, these two tables look like in this simplified picture:
This picture ...
- 1,120
8
votes
Accepted
Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?
In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
- 4,701
8
votes
Accepted
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
- 11.7k
8
votes
Accepted
DLL starting with DCD
Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages.
I found a project which claims to decompress such files:
...
- 36.4k
7
votes
Accepted
Retrieving the contents of PE file sections
As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().
- 20.7k
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.7k
7
votes
Accepted
How .reloc Section is used in PE file?
"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it?
It means even if you have space after your block finished, you must use next 32-bit aligned ...
7
votes
Is it possible for a .exe PE file to do something without any imports at all?
void main (void)
{
__asm
{
retn
}
}
compiled and linked using
cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
- 16.3k
6
votes
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer:
For a dump to work correctly, there are a couple of more things you need to do ...
- 1,063
6
votes
Accepted
IDA Strange exception before code is executed
One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.
- 36.4k
6
votes
Accepted
Disassembling at a memory address
Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one.
Disassemble at a specific address
In order to disassemble the ...
- 8,919
5
votes
Accepted
What are the side effects of setting the timestamp in the PE-header to 0?
Does this have any side-effects?
No, the Windows loader doesn't care about the timestamp in an EXE's PE header.
Are there compiler/linker flags to get this automatically?
No, Visual C++'s link....
- 20.7k
5
votes
Accepted
How to find all functions in DLL
You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
- 12.9k
5
votes
Accepted
How to recognize PE sections containing code?
Specifically, is a .text or .code section always considered to contain code?
No.
And what is the relationship between the IMAGE_SCN_CNT_CODE flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE flag (...
- 20.7k
5
votes
Check if exe is 64-bit
Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary:
Right-click on the application.
Click Properties.
Click the Compatibility tab.
In the ...
- 2,234
5
votes
Accepted
Wierd names in import table
As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names:
public: __thiscall ...
- 4,470
5
votes
Is it possible for a .exe PE file to do something without any imports at all?
Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov:
Unfortunately the 97 byte PE file does not work on Windows 2000. This
is ...
- 36.4k
5
votes
Adding section. Error starting the application (0xc000007b)
blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course.
For this ...
- 632
5
votes
Accepted
PE DOS stub content not commands
This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
- 36.4k
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
5
votes
.00cfg section in the PE file
Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
- 36.4k
5
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c):
BOOL __cdecl ...
- 36.4k
5
votes
Accepted
How can I get xrefs to class member variables in IDA?
The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays).
In IDA 7.4 and ...
- 9,178
4
votes
Accepted
Malware samples to analyze with existing disassembly?
The archive of disassembled and analysed malware does not exist - at least I haven't heard of any good ones. The closest I can think of is labs files from "Practical Malware Analysis", at https://...
- 843
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
Accepted
How to know if PE Header import function is being imported by Ordinal rather than by name
Extracted from http://www.pelib.com/:
First, the bit IMAGE_ORDINAL_FLAG (that is: the MSB) of the
IMAGE_THUNK_DATA in the arrays can be set, in which case there is no
symbol-name-information in ...
- 1,257
Only top scored, non community-wiki answers of a minimum length are eligible