Questions tagged [portable-executable]
The Portable Executable (PE) format, a modification of COFF, is the file format for executable binaries under the Windows operating system. The PE format is easily recognized by its "MZ DOS header" (0x4d 0x5a, "MZ" for "Mark Zbikowski").
1,006
questions
0
votes
0
answers
59
views
How to generate relocation table
I am writing a compiler from scratch with absolutely no dependency, so I am trying to generate a binary without llvm,...
I already figured out how to generate headers and .text section, but for the ....
0
votes
1
answer
41
views
why do all elements of the relocation table have an additional offset?
The question is about loading portable executable images to a random address.
Let's take kernel32.dll as an example, loaded at 0x75A00000.
I can see that at offset 0x10e15 from the image, there is an ...
1
vote
0
answers
17
views
Significant delays when an app with a signed component starts (should we sign components?)
We have ActiveX components (OCXs/DLLs) and .NET components (DLLs) used by our customers to build end-user apps for the Windows platform. All these components are digitally signed before they reach the ...
1
vote
1
answer
24
views
How to parse e_magic and e_lfanew so as to understand whether it is a PE file in Python with Pefile?
I have downloaded a file via this link:
https://downloads.sourceforge.net/project/mingw/Installer/mingw-get-setup.exe?ts=gAAAAABi5vYXXchWwmfZlmf0s7uR-VDPFjt_6mO12v4iHHvw9JUle2xu-...
0
votes
0
answers
63
views
the icon on PE file doen`t change
I'm trying to change the icon of EXE file (path to EXE file is writing from console) by absolute path to image (.ico). Tried this code but nothing changed. Have anybody some ideas how to change the ...
0
votes
0
answers
45
views
Flutter compile for windows need visual studio installed
when a run 'flutter doctor', the result is:
[X] Visual Studio - develop for Windows
X Visual Studio not installed; this is necessary for Windows development.
Download at https://visualstudio....
0
votes
0
answers
10
views
virustotal API parameter in peframe (virustotal.py -> get_result)
I wonder parameter's meaning that 'full=True' in function get_result in virustotal.py in peframe.
what difference full=True and full=False?
I guess full is variable.
But I think full is not variable..
...
1
vote
0
answers
40
views
Find global variable at runtime in memory based on PE image base
I'm trying to find a global variable of a PE image at runtime in memory (programatically). When looking at the initialization of the variable in IDA (disassembler), it looks like this:
ASM:
mov cs:...
0
votes
0
answers
24
views
How to set up the issuer of the certificate is Microsoft testing root certificate authority?
I use makecert.exe to get a KM_test1.cer, and then run signtool sign <myfile.dll> to sign myfile.dll. but it failed when I run signtool verify <myfile.dll>.
C:\Windows\System32>>...
3
votes
1
answer
110
views
How to write 'Hello_world' EFI application in NASM?
I'm trying to write a 'Hello_world' EFI application in NASM but can't seem to be able to get it working. When I run the application (in VirtualBox), it doesn't print anything. It just hangs. Here's my ...
0
votes
0
answers
46
views
How to read data from ".data" section of a process?
So, as far as I understand from looking online, the .data section of the PE file contains the static and global variables of the program.
All I am trying to do is create a variable in Python, or write ...
0
votes
0
answers
23
views
Code-Sign an Authenticode PE file using keys in a HSM in Linux
I need a non-windows (linux or FreeBSD) way of signing a boot executable(EFI binaries) in the Authenticode PE format.
Currently there are some tools like pbsign, sbsign, uefisign, osslsigncode on *nix ...
1
vote
1
answer
44
views
Is there an ELF equivelant of PE Original Filename
On Windows, PE files (executable files) have a property "Original Filename", which is the filename when the executable was built. For signed files, this means you can't change "svchost....
0
votes
1
answer
37
views
How to realign sections of a x64 portable executable based on section alignment field
I have been searching high and low for an easy way to manually align any x64 PE to 0x10000 section alignment and all i could find was pe file aligment or realignment.
As a test case i used the source ...
2
votes
1
answer
101
views
Manually loading PE imports results error when parsing PIMAGE_IMPORT_DESCRIPTOR
Greetings overflowers,
Almost completed my associates degree in cybersecurity. Trying to manually load imports from a dll that's in byte code. The virtual address and size of PIMAGE_DATA_DIRECTORY ...
0
votes
0
answers
19
views
Inserting new code caves inside sections of windows PE malware files
I am trying to insert the new code caves inside windows malware PE files by expanding the size of existing sections. I was able to dig out the existing code caves in the file but expanding the size of ...
0
votes
1
answer
23
views
C++ LinkTime/CompileTime Generate Function Offset From Start Of .Text Section Or Other Reference Point
So I have a need for a way to get an offset of a function from its PE files .text region/whatever section it is in, or within reference to another function within the file.
I'd like to do something ...
0
votes
0
answers
46
views
Difference between .rdata and .text section of DLL
I'm trying to write a trampoline function/hook for a misbehaving function in a DLL (Windows, 32 bit, no source available). After failing to do it the "traditional" way, I noticed that the ...
1
vote
0
answers
26
views
What kind of library contents dumpbin as neither symbols or exports?
Generally speaking, dumpbin /symbols shows the symbols exported from a static library, and dumpbin /exports shows the symbols exported from a dynamic library.
I have encountered a library that doesn't ...
1
vote
1
answer
49
views
Why do I get an undefined reference although everything seems alright ? (C++ Mingw)
My problem is fairly trivial and simple, I am trying to write a packer and to do so I need to parse PE files, so I'm trying to use the C++ pe-parse library.
I built it following the instructions and I'...
0
votes
1
answer
39
views
What is the rva and base address in the portable executable format?
I need help to understand these concepts.
I understand that the rva is an offset from the base address. But Its relative to what in a file? I understood it was from where the image will be loaded in ...
1
vote
0
answers
24
views
How to sign user space binary with force integrity check (deprecated MSFT cross-signing)
We used to have a binary running in user space built with VC++ /integritycheck flag which sets IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY flag on executable (see more here and here). We signed it with ...
0
votes
0
answers
13
views
Best currently available tool for diffing windows binaries?
Are any currently available tools that allow diffing of windows binaries (.dll and .exe), but ignore timestamp information?
ie, I'd like to compile the exact same binary twice in a row, and have the ...
0
votes
1
answer
37
views
can't extract sha256 signature from PE file with pyOpenSSL
I have an executable, that has 2 signatures:
Took the get_certificates function from here:
def get_certificates(self):
from OpenSSL.crypto import _lib, _ffi, X509
"""
https://github....
-1
votes
1
answer
29
views
What sort of address is 0x0000000140001000?
I'm using IDA Pro and right at the top of file is a field labelled Imagebase. Would this address be a absolute virtual address or relative virtual address or something else ?
0x0000000140001000
0
votes
0
answers
39
views
What may be the reason of false malware alarms on this exe I generate?
my friend who is on windows xp and cant post question
send me a question to post for him:
i wrote an x86 32-bit-windows assembler (named org-asm)
the problem is some antivirs report the output exe as ...
0
votes
1
answer
66
views
How to pass the Image pointer to Image_dos_header in windows
How to properly construct the NtHeader when calling PIMAGE_NT_HEADERS64 Microsoft docs does not seem to have much remarks on this function, the problem is that casting from void* to DWORD fails
int ...
0
votes
2
answers
25
views
Compiling/packaging java programs into standalone executables?
I would like to deploy a java (or javafx program) which is usable even on a system that doesn't have JRE.
This question has been asked and answered:
How can I convert my Java program to an .exe file?
...
0
votes
0
answers
64
views
How to calculate the 64 bit virtual address of the start of the .text (code) section
I'm trying to calculate the 64 bit virtual address for the start and consequently the end of the code (.text) section for ntoskrnl.exe in my 64 bit KMDF driver. I'm not certain if my calculations are ...
0
votes
0
answers
48
views
How to tell the gcc linker to add a .reloc section?
I want my C executable to contain the base relocation table.
but the linker doesn't add it.
is there a way I can tell it to add the base relocation table?
0
votes
1
answer
85
views
Is there a kernel mode API that allows safe access to ntoskrnl.exe address space
I'm just playing around for fun only(on Windows 8.1) with kernel mode address space trying to see if I can access the address space belonging to ntoskrnl.exe from my KMDF driver. So far I've run into ...
0
votes
1
answer
84
views
How to calculate a address of a function using base address without using hard coded values
So I'm trying to calculate, using C code the 64 bit virtual address of a function located in ntoskrnl.exe. I have, using C code, determined the base address of this executable. This address coincides ...
1
vote
1
answer
53
views
Call functions from data segment
I would like to do a reverse engineering analysis of the "xormadness.exe" executable file from root-me.org (PE x86 format), but i don't understand why functions are called from the data ...
1
vote
1
answer
37
views
Why singleton in headers not work for Windows/MinGW?
Here are my codes for PoC:
a.h: which implements a singleton method to create A instance
#pragma once
class A
{
public:
int a;
static A& Instance() {
static A a;
return a;
}
};
b.h:...
1
vote
1
answer
60
views
When reading a file in C Lang, what is the data type of the file you read using the "rb" property?
I am making a program to parse PE structure with C. I'm going to bring it in binary and parse it in length. Example) DOS header is 0x40(64) bytes long, so I tried to approach it from binary_buf[0] to ...
0
votes
0
answers
66
views
What does the MajorOperatingSystemVersion number mean in PE Optional Headers?
I am studying my own sample EXE file (A hello world program written in C) for educational purposes and I don't understand what the MajorOperatingSystemVersion value means.
The 2 byte field has a value ...
1
vote
1
answer
83
views
How to convert a hex TimeDateStamp DWORD value into human readable format?
Can anyone explain how to convert a Hex TimeDateStamp DWORD value into human readable format?
I'm just curious as to how a value such as 0x62444DB4 is converted into
"Wednesday, 30 March 2022 10:...
0
votes
0
answers
28
views
Anyone know where I can find the structure definition of the optional header of a 32bit executable? I can't seem to find it in the winnt.h file
I was able to locate the DOS header, NT header and file header of Portable Executables in the winnt.h file. I wasn't able to locate the definition of optional headers using the find function in ...
0
votes
0
answers
97
views
Get PE build version from resource directory in UEFI bootloader
I'm trying to get the build number from a 64-bit PE file (from the resource directory), namely the Windows bootmanager (bootmgfw.efi), using an UEFI bootloader. Currently I'm doing the following: Load ...
0
votes
1
answer
83
views
How loader find exact location of an exported function from a dll?
I open a binary in the PEView. There is a table which is called Import Name Table under .rdata section of the binary. This table show me imported functions from different DLLs but there is a field in ...
0
votes
0
answers
110
views
Python pefile analysis lief and pefile giving different values for e_lfanew
I am using lief and pefile modules to analyse PE32 files in python. When getting the dos header data, everything seems to be the same between the two modules except for the e_lfanew field which should ...
1
vote
0
answers
45
views
I'm trying to export the contents of a process after dynamic linking in order to make a static version of the PE. Can it be done this way?
Let's say I have a PE that leverages dynamically linked libs and I want to statically link everything. And I don't have the source code, so using compiler flags isn't an option. I've been trying to ...
0
votes
1
answer
116
views
How to locate PE header of MSI files
The PE Format specification for image (.exe) and object files describes how to locate the start of the PE header.
However, I am trying to find the PE header of an MSI, and neither the approach for ...
0
votes
1
answer
118
views
Can't create a relocatable pe file with cl that generates a ".reloc" section
that's my first question on stack overflow. I'm writing a kernel, and I'm looking for running drivers. The kernel can run some simple user applications in pe32+ format that loads on a fixed virtual ...
1
vote
1
answer
74
views
error while getting function ordinal from the IDT table - mapping PE - c++
I'm trying to map a PE file in memory but I got to this point where I get to a read access violation.
The error happens when reading the address of the function used from DLLs from IDT and adding them ...
0
votes
0
answers
248
views
How to parse the resource section of a PE executable using C/C++?
I am trying to understand how PE files work and I'm developing a small application in C/C++ as well as Python to parse a *.exe file and get the version information only from the file.
In essence I'm ...
-1
votes
1
answer
50
views
How can Java run a PE32 when passed to its class path?
I've been wanting to reverse engineer this clients launcher in an effort to understand how the game was launching as a Java application despite it only having a PE32 executable alongside it.
The ...
2
votes
1
answer
249
views
How do I show the PE headers in IDA pro?
I distinctly remember, at some point, being able to expand the PE header and look at everything stored in it on IDA, however when I look at it now it just shows some basic information from the headers ...
0
votes
0
answers
42
views
How can I run a DLL in a compiled (Pyinstaller/Py2exe) python executable (in the script itself)
First, I'd like to say that I'm using this methods for evasion and research purposes, and not as best practice to achieve said functionality
I want to create a python script which will load a DLL that ...
0
votes
1
answer
111
views
Finding function offset from file from RVA
I want to find a function inside my .exe, and memcpy it somewhere else.
I have used the IDIA SDK to parse the .pdb file for my .exe, which contains a simple function named "myFunction", ...