Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
510
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
900
Overview of file type identifiers
ange
0
1.2k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
900
Generating Weird Files
ange
0
420
Technical challenges with file formats
ange
1
2.3k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
小学4年生夏休みの自由研究「ぼくと Copilot エージェント」
taichinakamura
0
510
スタートアップにおけるこれからの「データ整備」
shomaekawa
1
300
成長自己責任時代のあるきかた/How to navigate the era of personal responsibility for growth
kwappa
4
290
AI時代だからこそ考える、僕らが本当につくりたいスクラムチーム / A Scrum Team we really want to create in this AI era
takaking22
7
3.9k
職種別ミートアップで社内から盛り上げる アウトプット文化の醸成と関係強化/ #DevRelKaigi
nishiuma
2
150
ZOZOのAI活用実践〜社内基盤からサービス応用まで〜
zozotech
PRO
0
210
Function calling機能をPLaMo2に実装するには / PFN LLMセミナー
pfn
PRO
0
980
AI駆動開発を推進するためにサービス開発チームで 取り組んでいること
noayaoshiro
0
230
そのWAFのブロック、どう活かす? サービスを守るための実践的多層防御と思考法 / WAF blocks defense decision
kaminashi
0
110
Vibe Coding Year in Review. From Karpathy to Real-World Agents by Niels Rolland, CEO Paatch
vcoisne
0
100
Findy Team+のSOC2取得までの道のり
rvirus0817
0
480
オープンソースでどこまでできる?フォーマル検証チャレンジ
msyksphinz
0
120
Featured
See All Featured
Git: the NoSQL Database
bkeepers
PRO
431
66k
Practical Orchestrator
shlominoach
190
11k
We Have a Design System, Now What?
morganepeng
53
7.8k
jQuery: Nuts, Bolts and Bling
dougneiner
64
7.9k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
9
970
Writing Fast Ruby
sferik
629
62k
What's in a price? How to price your products and services
michaelherold
246
12k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
32
1.6k
GraphQLの誤解/rethinking-graphql
sonatard
73
11k
Why Our Code Smells
bkeepers
PRO
339
57k
It's Worth the Effort
3n
187
28k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
189
55k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None