Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
440
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Overview of file type identifiers
ange
0
870
A question of time
ange
0
990
SBuD: InfoVis in InfoSec
ange
1
800
Generating Weird Files
ange
0
260
Technical challenges with file formats
ange
1
2.1k
Inside out - abusing archive file formats
ange
3
1.8k
Relations between archive formats
ange
0
1.9k
Beyond your studies v2
ange
2
920
Generating weird files
ange
0
3.5k
Other Decks in Technology
See All in Technology
社内イベント管理システムを1週間でAKSからACAに移行した話し
shingo_kawahara
0
200
能動的ドメイン名ライフサイクル管理のすゝめ / Practice on Active Domain Name Lifecycle Management
nttcom
0
250
podman_update_2024-12
orimanabu
1
290
なぜCodeceptJSを選んだか
goataka
0
180
生成AIのガバナンスの全体像と現実解
fnifni
1
210
開発生産性向上! 育成を「改善」と捉えるエンジニア育成戦略
shoota
2
470
組み込みアプリパフォーマンス格闘記 検索画面編
wataruhigasi
1
150
Google Cloud で始める Cloud Run 〜AWSとの比較と実例デモで解説〜
risatube
PRO
0
120
オプトインカメラ:UWB測位を応用したオプトイン型のカメラ計測
matthewlujp
0
210
WACATE2024冬セッション資料(ユーザビリティ)
scarletplover
0
330
AWS re:Invent 2024 ふりかえり勉強会
yhana
0
480
[Oracle TechNight#85] Oracle Autonomous Databaseを使ったAI活用入門
oracle4engineer
PRO
1
140
Featured
See All Featured
Git: the NoSQL Database
bkeepers
PRO
427
64k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
29
2k
Become a Pro
speakerdeck
PRO
26
5k
Imperfection Machines: The Place of Print at Facebook
scottboms
266
13k
How to Ace a Technical Interview
jacobian
276
23k
No one is an island. Learnings from fostering a developers community.
thoeni
19
3k
Building Better People: How to give real-time feedback that sticks.
wjessup
366
19k
It's Worth the Effort
3n
183
28k
Java REST API Framework Comparison - PWX 2021
mraible
28
8.3k
Building a Scalable Design System with Sketch
lauravandoore
460
33k
GraphQLとの向き合い方2022年版
quramy
44
13k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
8
1.2k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None