Skip to main content
17 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
Megabeets's user avatar
  • 8,999
12 votes
Accepted

Is it possible for a .exe PE file to do something without any imports at all?

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four ...
NirIzr's user avatar
  • 11.8k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
Megabeets's user avatar
  • 8,999
9 votes

Import table vs Import Address Table

First, beside “yours” two tables, I introduce a third one, the Import Lookup Table. Side by side with the Import Address Table, these two tables look like in this simplified picture: This picture ...
MarianD's user avatar
  • 1,130
8 votes
Accepted

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
peter ferrie's user avatar
  • 4,709
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

DLL starting with DCD

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: ...
Igor Skochinsky's user avatar
  • 36.7k
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

How .reloc Section is used in PE file?

"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it? It means even if you have space after your block finished, you must use next 32-bit aligned ...
Kerim Can Kalıpcıoğlu's user avatar
7 votes

Is it possible for a .exe PE file to do something without any imports at all?

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
blabb's user avatar
  • 16.4k
6 votes
Accepted

IDA Strange exception before code is executed

One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.
Igor Skochinsky's user avatar
  • 36.7k
6 votes
Accepted

Disassembling at a memory address

Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one. Disassemble at a specific address In order to disassemble the ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
joxeankoret's user avatar
  • 4,488
5 votes

Check if exe is 64-bit

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...
dsasmblr's user avatar
  • 2,234
5 votes
Accepted

How to find all functions in DLL

You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
Guntram Blohm's user avatar
5 votes

Is it possible for a .exe PE file to do something without any imports at all?

Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov: Unfortunately the 97 byte PE file does not work on Windows 2000. This is ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes

Adding section. Error starting the application (0xc000007b)

blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course. For this ...
conio's user avatar
  • 672
5 votes
Accepted

PE DOS stub content not commands

This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
5 votes

.00cfg section in the PE file

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes
Accepted

How can I get xrefs to class member variables in IDA?

The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays). In IDA 7.4 and ...
Rolf Rolles's user avatar
  • 9,198
4 votes
Accepted

"SR" instead of "MZ"

Probably it's just a measure to prevent scanning of the file by standard antiviruses. I suspect the malware either restores MZ before actually running the file, or uses a custom loader (a la RunPE) to ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes
Accepted

How to know if PE Header import function is being imported by Ordinal rather than by name

Extracted from http://www.pelib.com/: First, the bit IMAGE_ORDINAL_FLAG (that is: the MSB) of the IMAGE_THUNK_DATA in the arrays can be set, in which case there is no symbol-name-information in ...
knx's user avatar
  • 1,257
4 votes
Accepted

Malware samples to analyze with existing disassembly?

The archive of disassembled and analysed malware does not exist - at least I haven't heard of any good ones. The closest I can think of is labs files from "Practical Malware Analysis", at https://...
Vitaly Osipov's user avatar
4 votes

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
byteptr's user avatar
  • 141
4 votes

How to display .text section of a PE in radare2?

In accordance with the manual of radare, I notice that the command S and Sd of radare2 are depreciated. You can have a few issues with using it in some ways such as use it on a elf file. Use iS and iO ...
ultimate-anti-reversing's user avatar
4 votes

PE Sections Permissions

You can use DUMPBIN for examining section permissions. If you run it with no other argument than executable name it shows sections in executable. C:\> dumpbin ConsoleApplication1.exe Microsoft (R) ...
Kerim Can Kalıpcıoğlu's user avatar
4 votes
Accepted

PE file format: How can I find the heap memory space in a running WinNT program?

Short answer: The heap, stack and other PE loader related tasks are not part of the PE standard or definition. General Information the PE file does not describe the entire memory space of an ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

What PE anomalies can crash the Windows Loader or cause a file to not load?

Based on my experience, these type of errors could happen when MajorOperatingSystem/MinorOperatingSystem and/or MajorSubsystemVersion/MinorSubsystemVersion are not compatible with the system you are ...
ubnix's user avatar
  • 1,073

Only top scored, non community-wiki answers of a minimum length are eligible