17
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 9,019
12
votes
Accepted
Is it possible for a .exe PE file to do something without any imports at all?
Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level.
I can think of four ...
- 11.8k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 9,019
9
votes
Import table vs Import Address Table
First, beside “yours” two tables, I introduce a third one, the Import Lookup Table.
Side by side with the Import Address Table, these two tables look like in this simplified picture:
This picture ...
- 1,132
8
votes
Accepted
Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?
In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
- 4,709
8
votes
Accepted
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
- 11.8k
8
votes
Accepted
DLL starting with DCD
Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages.
I found a project which claims to decompress such files:
...
- 36.9k
7
votes
Accepted
How .reloc Section is used in PE file?
"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it?
It means even if you have space after your block finished, you must use next 32-bit aligned ...
7
votes
Accepted
Adding a new PE section for a code cave
Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
- 11.8k
7
votes
Is it possible for a .exe PE file to do something without any imports at all?
void main (void)
{
__asm
{
retn
}
}
compiled and linked using
cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
- 16.7k
6
votes
Accepted
IDA Strange exception before code is executed
One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.
- 36.9k
6
votes
Accepted
Disassembling at a memory address
Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one.
Disassemble at a specific address
In order to disassemble the ...
- 9,019
5
votes
Check if exe is 64-bit
Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary:
Right-click on the application.
Click Properties.
Click the Compatibility tab.
In the ...
- 2,254
5
votes
Is it possible for a .exe PE file to do something without any imports at all?
Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov:
Unfortunately the 97 byte PE file does not work on Windows 2000. This
is ...
- 36.9k
5
votes
Adding section. Error starting the application (0xc000007b)
blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course.
For this ...
- 682
5
votes
Accepted
PE DOS stub content not commands
This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
- 36.9k
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
5
votes
Accepted
Determining endianness of PE files (Windows on ARM?)
Windows platforms have a fixed endianness and do not support running different endianness files. The file format itself uses always little-endian fields.
AFAIK the only Windows platform supporting ...
- 36.9k
5
votes
.00cfg section in the PE file
Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
- 36.9k
5
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c):
BOOL __cdecl ...
- 36.9k
5
votes
Accepted
How can I get xrefs to class member variables in IDA?
The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays).
In IDA 7.4 and ...
- 9,218
4
votes
Accepted
Exports that redirects to other library
This is called export forwarding and you can explore it here with nice explanation:
The PE file format
The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of
exported items. It ...
- 3,072
4
votes
Accepted
How can WinDbg be used to troubleshoot program loading?
I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
- 36.9k
4
votes
Accepted
What PE anomalies can crash the Windows Loader or cause a file to not load?
Based on my experience, these type of errors could happen when MajorOperatingSystem/MinorOperatingSystem and/or MajorSubsystemVersion/MinorSubsystemVersion are not compatible with the system you are ...
- 1,073
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
Accepted
(bad) opcodes of objdump
You are correct, and objdump is actually wrong to disassemble such instruction, only to mark it as (bad) in a later stage.
Here is how it works:
db a5 4e 9c 95 68 lock (bad) [rbp+0x68959c4e]
db ...
- 2,374
4
votes
Accepted
"SR" instead of "MZ"
Probably it's just a measure to prevent scanning of the file by standard antiviruses. I suspect the malware either restores MZ before actually running the file, or uses a custom loader (a la RunPE) to ...
- 36.9k
4
votes
Accepted
PE file format: How can I find the heap memory space in a running WinNT program?
Short answer: The heap, stack and other PE loader related tasks are not part of the PE standard or definition.
General Information
the PE file does not describe the entire memory space of an ...
- 11.8k
4
votes
How to display .text section of a PE in radare2?
In accordance with the manual of radare, I notice that the command S and Sd of radare2 are depreciated. You can have a few issues with using it in some ways such as use it on a elf file. Use iS and iO ...
4
votes
PE Sections Permissions
You can use DUMPBIN for examining section permissions. If you run it with no other argument than executable name it shows sections in executable.
C:\> dumpbin ConsoleApplication1.exe
Microsoft (R) ...
Only top scored, non community-wiki answers of a minimum length are eligible