Hot answers tagged

25

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


15

why is the default imagebase value 0x400000? From http://msdn.microsoft.com/en-us/library/ms809762.aspx -- In executables produced for Windows NT, the default image base is 0x10000. For DLLs, the default is 0x400000. In Windows 95, the address 0x10000 can't be used to load 32-bit EXEs because it lies within a linear address region shared by all ...


14

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


13

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT) To quote from the PE ...


11

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders. Set SizeOfHeaders to AddressOfEntryPoint to make it work. The error you get is defined in ntstatus.h as follows: // // MessageId: STATUS_INVALID_IMAGE_FORMAT // // MessageText: // // {Bad Image} // %hs is either not designed to run on Windows or it ...


11

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


11

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four types of reasonable, useable executable file types that may not have any imports: An executable that does not require any OS APIs. This is somewhat similar to ...


10

It is not that easy, or it is rather error prone. If you are going to insert 3 bytes in place of 2 bytes, you would be better off if you do a trampoline: jump to some other place, do what you want, then jump back to the next instruction. By employing trampolining, you can also save the registers. A small sample could be like this: jmp SomePlace <---...


9

I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal. The first step is to find the base address of the image loaded into memory. This step will be different depending on if the executable has or hasn't been mapped into memory, but the basic idea will ...


9

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...


8

TL;DR you can call anything, locating the right part of code is the hard part. export table If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation. locating any function IDA If ...


8

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical byte long will have the entire 4kb of memory allocated for it. The first section is mapped into memory after the file header, so it will be 4kb away from the ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


7

You appear to be missing the corner cases such as mis-aligned pointers (should round down) and sizes (should round up). However, even the rounding has corner cases - the physical pointer should be rounded down to a multiple of 512, regardless of the value in the header, but the read size is rounded up by using a combination of the file alignment and 4kb. ...


7

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit


7

Microsoft documentation gives WinMain() as the entry point for a Windows program No, Microsoft's documentation doesn't give WinMain() as the entry point for a Windows program. From the WinMain() documentation to which you linked above (emphasis mine) - "WinMain entry point [is] the user-provided entry point for a graphical Windows-based application... ...


7

NX: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT != 0 ASLR: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE != 0 SAFESEH: (IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress != 0) && (IMAGE_OPTIONAL_HEADER.DataDirectory[...


7

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file optional "extensions". Although LordPE is a great tool, it isn't the best tool for this task. It is too low-level, and doesn't let you create a complete new section ...


7

"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it? It means even if you have space after your block finished, you must use next 32-bit aligned address for your RVA. In my opinion, it is mostly because of page optimization. You can read this document for further understanding. Do PE files use ...


7

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: Supported file types DCN v1 DCM v1 DCS v1 DCD v1 Type descriptions Header Sign: 0x44 0x43 0x4E 0x01, DCN 01 (packed IPD PA30) Header ...


6

Given that you don't already have the .obj files, it doesn't make sense to try to generate the .obj files from the .exe and .pdb files and then reverse engineer the generated .obj files. If you were to do this then the .obj files wouldn't have any information in them that was not already in the .exe or .pdb files. As such, you're better off just working with ...


6

No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]. Furthermore, the RUNTIME_FUNCTION structs don't need to be in "a separate COFF section".


6

This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer: For a dump to work correctly, there are a couple of more things you need to do besides fixing the section headers: Travel the data directories and make sure they all point to the proper table Once you are sure the data directories point to the ...


6

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().


6

One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.


6

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:windows /ALIGN:128 /DRIVER will create a working PE file **edit ** // win 7 sp1 32 bit machine and ewdk 1703 cl.exe unsigned long long time = ...


6

Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one. Disassemble at a specific address In order to disassemble the code at a specific memory address using radare2 you should use the pd @ <address> command. pd[?] [sz] [a] [b] — disassemble N opcodes (pd) or N bytes ...


5

If you purpose to reverse engineer the game is order to learn the way it was made you will most likely end up having C/C++ files recreated (at least of major components). I am afraid there is no way you can reverse something and have full understanding of internal workings without firm grip on assembly. There are several tool that could aid you in your work....


5

Blackstorm portal has a huge collection of Unpacking tutorials Blackstorm portal tutorials Tuts4You has another large collection of unpacking tutorials Tuts4You It took me a long time at first but over time unpacking got a lot easier, lots of patience and practice required though.


5

A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ, the initials of one of the developers of MS-DOS. The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number ...


Only top voted, non community-wiki answers of a minimum length are eligible