Skip to main content
9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
Paweł Łukasik's user avatar
5 votes

.00cfg section in the PE file

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

PE DOS stub content not commands

This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes

PDB file vs SDB file?

While sdb files was created to translate imports that are referenced by ordinal instead of by name (see "Exporting Functions from a DLL by Ordinal Rather Than by Name"), pdb files are something ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

What is an SDB file?

SDB stands for String Database. sdb is a simple string key/value database based on cdb disk storage and supports JSON and arrays introspection. You can see the SDB commands listed with the k ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

Should the Delay Import Directory contain virtual addresses?

Delayed imports are not processed by the system loader, so the programmer can put into it any kind of data, as long as they're prepared to handle it. By convention (mostly because Visual C++ did it), ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

There is something else than a "DllMain" in a module for its initialization?

In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that ...
0xC0000022L's user avatar
  • 10.9k
2 votes

.00cfg section in the PE file

The most useful reference I've seen about this section is in this Adobe source comment: // // Allocate xyz in the .00cfg so that it is implicitly merged into the // import section of the binary (...
josh poley's user avatar
2 votes
Accepted

I'm trying to understand the SEH mechanism

int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?

The page you linked states that the ENCODING directive in the cfg file only applies to 1-byte-per-unit (1bpu) encodings, which this is not. UTF-16 is a 2bpu format. The ENCODING directive is important ...
Polynomial's user avatar
  • 1,272
2 votes
Accepted

How to find "RawAddress" of a "VirtualAddress"?

you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Analyzing a possibly malware sample

The weird sections are a sign that this sample is probably packed, especially the '.leopard' section. You can try to search if this section name is related to a known packer, and try to unpack it ...
Guillaume's user avatar
  • 709
1 vote
Accepted

Loading a PE32 executable DLL Intel 80386 into a c# program

You can't load 32bit Dlls in 64bit Processes Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP ...
llm's user avatar
  • 336
1 vote
Accepted

GetProcAddress with 0 as lpProcName

Turned out it was just a trick inserted in the code to distract us. What can I say, it was very successful haha. I ended up asking my teacher and he told me to try and avoid getting into that part of ...
Daniel Bejan's user avatar
1 vote

GetProcAddress with 0 as lpProcName

According to Microsoft Docs: GetProcAddress: lpProcName The function or variable name, or the function's ordinal value. If this parameter is an ordinal value, it must be in the low-order ...
Biswapriyo's user avatar
  • 1,569

Only top scored, non community-wiki answers of a minimum length are eligible