Lock in $30 Savings on PRO—Offer Ends Soon! ⏳
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
440
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Overview of file type identifiers
ange
0
820
A question of time
ange
0
970
SBuD: InfoVis in InfoSec
ange
1
790
Generating Weird Files
ange
0
240
Technical challenges with file formats
ange
1
2.1k
Inside out - abusing archive file formats
ange
3
1.8k
Relations between archive formats
ange
0
1.9k
Beyond your studies v2
ange
2
910
Generating weird files
ange
0
3.4k
Other Decks in Technology
See All in Technology
システムリプレイスプロジェクト発足から7年、改めてコスト最適化に向き合う / replace and cost optimization
takumi
1
360
ARRが3年で10倍になったプロダクト開発とAI活用の軌跡
akiroom
0
210
次のコンテナセキュリティの時代 - User Namespace With a Pod / CloudNative Days Winter 2024
pfn
PRO
5
470
Autonomous Database サービス・アップデート (FY25)
oracle4engineer
PRO
0
220
LINEヤフーにおける超大規模プラットフォーム実現への挑戦と学び / Challenges and Lessons in Building an Ultra-Large-Scale Platform at LY Corporation
hhiroshell
3
1k
ファインディの4年にわたる技術的負債の返済 / Repaying 4 Years of Technical Debt at Findy
ma3tk
6
3.3k
データカタログを自作したけど 運用しなかった話@Findy Lunch LT「データカタログ 事例から学ぶメタデータ管理の実態」
ryo_suzuki
2
630
Nihonbashi Test Talk #3_WebDriver BiDiと最新の実装状況 / WebDriver BiDi latest status
takeyaqa
1
110
GDGoC開発体験談 - Gemini生成AI活用ハッカソン / GASとFirebaseで挑むパン屋のフードロス解決 -
hotekagi
1
580
pmconf2024_UPSIDER
upsider_tech
0
3.8k
店舗向けSaaSにおける 顧客要望活用の実践アプローチ(20241205_pmconf)
yujirooo
0
1.5k
Oracle Database 23c新機能 #5 データベース・パフォーマンス関連新機能前半
oracle4engineer
PRO
1
140
Featured
See All Featured
For a Future-Friendly Web
brad_frost
175
9.4k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
47
5k
Designing for Performance
lara
604
68k
Become a Pro
speakerdeck
PRO
25
5k
Building a Scalable Design System with Sketch
lauravandoore
459
33k
Measuring & Analyzing Core Web Vitals
bluesmoon
4
150
Optimising Largest Contentful Paint
csswizardry
33
2.9k
Fontdeck: Realign not Redesign
paulrobertlloyd
82
5.3k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
656
59k
Stop Working from a Prison Cell
hatefulcrawdad
267
20k
Navigating Team Friction
lara
183
15k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
191
16k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None