Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
470
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
730
Overview of file type identifiers
ange
0
1k
A question of time
ange
0
1k
SBuD: InfoVis in InfoSec
ange
1
830
Generating Weird Files
ange
0
360
Technical challenges with file formats
ange
1
2.2k
Inside out - abusing archive file formats
ange
3
1.8k
Relations between archive formats
ange
0
2k
Beyond your studies v2
ange
2
960
Other Decks in Technology
See All in Technology
わたしがEMとして入社した「最初の100日」の過ごし方 / EMConfJp2025
daiksy
14
5.3k
データベースの負荷を紐解く/untangle-the-database-load
emiki
2
540
Ruby on Railsで持続可能な開発を行うために取り組んでいること
am1157154
3
160
AI自体のOps 〜LLMアプリの運用、AWSサービスとOSSの使い分け〜
minorun365
PRO
9
750
ABWG2024採択者が語るエンジニアとしての自分自身の見つけ方〜発信して、つながって、世界を広げていく〜
maimyyym
1
190
OPENLOGI Company Profile for engineer
hr01
1
20k
2025/3/1 公共交通オープンデータデイ2025
morohoshi
0
100
Two Blades, One Journey: Engineering While Managing
ohbarye
4
2.3k
手を動かしてレベルアップしよう!
maruto
0
240
30→150人のエンジニア組織拡大に伴うアジャイル文化を醸成する役割と取り組みの変化
nagata03
0
200
自分だけの仮想クラスタを高速かつ効率的に作る kubefork
donkomura
0
110
JAWS DAYS 2025 アーキテクチャ道場 事前説明会 / JAWS DAYS 2025 briefing document
naospon
0
2.6k
Featured
See All Featured
How GitHub (no longer) Works
holman
314
140k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
11
1.3k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.5k
Thoughts on Productivity
jonyablonski
69
4.5k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
29
1k
How to Think Like a Performance Engineer
csswizardry
22
1.4k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
46
2.4k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
49k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.7k
Rails Girls Zürich Keynote
gr2m
94
13k
How To Stay Up To Date on Web Technology
chriscoyier
790
250k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
49
2.3k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None