Hot answers tagged

25 votes
Accepted

Check if exe is 64-bit

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this ...
  • 789
16 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
  • 8,689
15 votes
Accepted

windows - Why is the imagebase default 0x400000?

why is the default imagebase value 0x400000? From Peering Inside the PE: A Tour of the Win32 Portable Executable File Format: In executables produced for Windows NT, the default image base is ...
14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
  • 159
11 votes
Accepted

PE .rdata section contents

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it ...
  • 1,960
11 votes
Accepted

Is it possible for a .exe PE file to do something without any imports at all?

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four ...
  • 11.4k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
  • 8,689
9 votes
Accepted

Get section's names and headers for a file using C++

I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal. The first step is to find the base ...
8 votes
Accepted

Real PE32(+) entry point - is it documented anywhere?

Microsoft documentation gives WinMain() as the entry point for a Windows program No, Microsoft's documentation doesn't give WinMain() as the entry point for a Windows program. From the WinMain() ...
8 votes
Accepted

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
  • 4,511
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
  • 11.4k
8 votes
Accepted

DLL starting with DCD

Looks like these files use a variation of the delta compression format (MSDelta) used previously for the Windows Update packages. I found a project which claims to decompress such files: ...
  • 35.1k
7 votes

Check if exe is 64-bit

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit
  • 221
7 votes
Accepted

how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag

NX: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT != 0 ASLR: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE != 0 SAFESEH: ...
7 votes
Accepted

Adding a new PE section for a code cave

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file ...
  • 11.4k
7 votes
Accepted

How .reloc Section is used in PE file?

"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it? It means even if you have space after your block finished, you must use next 32-bit aligned ...
6 votes
Accepted

Win64 .pdata required to be a separate COFF section?

No, the Windows loader doesn't care about the name of the .pdata section. It doesn't find the RUNTIME_FUNCTION structs based on the section name, but rather based on the content of NtHeader->...
6 votes

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer: For a dump to work correctly, there are a couple of more things you need to do ...
  • 1,043
6 votes
Accepted

Retrieving the contents of PE file sections

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().
6 votes
Accepted

IDA Strange exception before code is executed

One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.
  • 35.1k
6 votes

Is it possible for a .exe PE file to do something without any imports at all?

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
  • 15.2k
6 votes
Accepted

Disassembling at a memory address

Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one. Disassemble at a specific address In order to disassemble the ...
  • 8,689
6 votes

Import table vs Import Address Table

First, beside “yours” two tables, I introduce a third one, the Import Lookup Table. Side by side with the Import Address Table, these two tables look like in this simplified picture: This picture ...
  • 1,066
5 votes

Check if exe is 64-bit

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...
  • 2,164
5 votes
Accepted

Is the magic number important

A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ, the initials of one of the developers of MS-DOS. ...
  • 474
5 votes
Accepted

What is an indicator that a PE section definitely contains stuff of a specific type?

I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set. The presence of this flag doesn't "definitely" ...
5 votes
Accepted

How to recognize PE sections containing code?

Specifically, is a .text or .code section always considered to contain code? No. And what is the relationship between the IMAGE_SCN_CNT_CODE flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE flag (...
5 votes
Accepted

What are the side effects of setting the timestamp in the PE-header to 0?

Does this have any side-effects? No, the Windows loader doesn't care about the timestamp in an EXE's PE header. Are there compiler/linker flags to get this automatically? No, Visual C++'s link....
5 votes
Accepted

How to find all functions in DLL

You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
  • 4,325

Only top scored, non community-wiki answers of a minimum length are eligible