9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,952
5
votes
.00cfg section in the PE file
Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
- 36.9k
5
votes
Accepted
PE DOS stub content not commands
This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
- 36.9k
4
votes
PDB file vs SDB file?
While sdb files was created to translate imports that are referenced by ordinal instead of by name (see "Exporting Functions from a DLL by Ordinal Rather Than by Name"), pdb files are something ...
- 9,019
4
votes
Accepted
What is an SDB file?
SDB stands for String Database.
sdb is a simple string key/value database based on cdb disk
storage and supports JSON and arrays introspection.
You can see the SDB commands listed with the k ...
- 9,019
4
votes
Accepted
Should the Delay Import Directory contain virtual addresses?
Delayed imports are not processed by the system loader, so the programmer can put into it any kind of data, as long as they're prepared to handle it. By convention (mostly because Visual C++ did it), ...
- 36.9k
3
votes
Accepted
There is something else than a "DllMain" in a module for its initialization?
In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that ...
- 10.9k
2
votes
.00cfg section in the PE file
The most useful reference I've seen about this section is in this Adobe source comment:
//
// Allocate xyz in the .00cfg so that it is implicitly merged into the
// import section of the binary (...
- 861
2
votes
Accepted
I'm trying to understand the SEH mechanism
int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has ...
- 36.9k
2
votes
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The page you linked states that the ENCODING directive in the cfg file only applies to 1-byte-per-unit (1bpu) encodings, which this is not. UTF-16 is a 2bpu format.
The ENCODING directive is important ...
- 1,272
2
votes
Accepted
How to find "RawAddress" of a "VirtualAddress"?
you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the ...
- 36.9k
1
vote
Analyzing a possibly malware sample
The weird sections are a sign that this sample is probably packed, especially the '.leopard' section. You can try to search if this section name is related to a known packer, and try to unpack it ...
- 709
1
vote
Accepted
Loading a PE32 executable DLL Intel 80386 into a c# program
You can't load 32bit Dlls in 64bit Processes
Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP ...
- 336
1
vote
Accepted
GetProcAddress with 0 as lpProcName
Turned out it was just a trick inserted in the code to distract us. What can I say, it was very successful haha. I ended up asking my teacher and he told me to try and avoid getting into that part of ...
- 133
1
vote
GetProcAddress with 0 as lpProcName
According to Microsoft Docs: GetProcAddress:
lpProcName
The function or variable name, or the function's ordinal value. If
this parameter is an ordinal value, it must be in the low-order
...
- 1,589
Only top scored, non community-wiki answers of a minimum length are eligible