Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
490
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
840
Overview of file type identifiers
ange
0
1.1k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
870
Generating Weird Files
ange
0
390
Technical challenges with file formats
ange
1
2.2k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
KiCadでPad on Viaの基板作ってみた
iotengineer22
0
290
生成AI開発案件におけるClineの業務活用事例とTips
shinya337
0
240
AIの全社活用を推進するための安全なレールを敷いた話
shoheimitani
2
460
What’s new in Android development tools
yanzm
0
240
SaaS型なのに自由度の高い本格CMSでサイト構築と運用のコスパ&タイパUP! MovableType.net の便利機能とユーザー事例のご紹介
masakah
0
100
【5分でわかる】セーフィー エンジニア向け会社紹介
safie_recruit
0
27k
Core Audio tapを使ったリアルタイム音声処理のお話
yuta0306
0
190
Operating Operator
shhnjk
1
530
Oracle Database@Google Cloud:サービス概要のご紹介
oracle4engineer
PRO
0
100
AWS Organizations 新機能!マルチパーティ承認の紹介
yhana
1
270
Glacierだからってコストあきらめてない? / JAWS Meet Glacier Cost
taishin
1
150
ビズリーチにおけるリアーキテクティング実践事例 / JJUG CCC 2025 Spring
visional_engineering_and_design
1
110
Featured
See All Featured
Documentation Writing (for coders)
carmenintech
72
4.9k
Unsuck your backbone
ammeep
671
58k
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.8k
How To Stay Up To Date on Web Technology
chriscoyier
790
250k
GraphQLの誤解/rethinking-graphql
sonatard
71
11k
Become a Pro
speakerdeck
PRO
28
5.4k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
233
17k
Principles of Awesome APIs and How to Build Them.
keavy
126
17k
RailsConf 2023
tenderlove
30
1.1k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.8k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Build your cross-platform service in a week with App Engine
jlugia
231
18k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None