Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
500
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
850
Overview of file type identifiers
ange
0
1.2k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
880
Generating Weird Files
ange
0
400
Technical challenges with file formats
ange
1
2.3k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
新規事業におけるAIリサーチの活用例
ranxxx
0
170
手動からの解放!!Strands Agents で実現する総合テスト自動化
ideaws
3
390
今日からあなたもGeminiを好きになる
subaruhello
1
660
alecthomas/kong はいいぞ
fujiwara3
6
1.1k
VLMサービスを用いた請求書データ化検証 / SaaSxML_Session_1
sansan_randd
0
130
完璧を目指さない小さく始める信頼性向上
kakehashi
PRO
0
120
2025/07/22_家族アルバム みてねのCRE における生成AI活用事例
masartz
2
140
AIエージェントを支える設計
tkikuchi1002
11
2.4k
[MIRU2025]Preference Optimization for Multimodal Large Language Models for Image Captioning Tasks
keio_smilab
PRO
0
110
CSPヘッダー導入で実現するWebサイトの多層防御:今すぐ試せる設定例と運用知見
llamakko
1
270
MCPと認可まわりの話 / mcp_and_authorization
convto
2
300
解消したはずが…技術と人間のエラーが交錯する恐怖体験
lamaglama39
0
140
Featured
See All Featured
Site-Speed That Sticks
csswizardry
10
730
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
331
22k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
45
7.5k
Fireside Chat
paigeccino
37
3.5k
GraphQLとの向き合い方2022年版
quramy
49
14k
Building Flexible Design Systems
yeseniaperezcruz
328
39k
Building Better People: How to give real-time feedback that sticks.
wjessup
367
19k
A Modern Web Designer's Workflow
chriscoyier
695
190k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
15
1.6k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Git: the NoSQL Database
bkeepers
PRO
431
65k
How GitHub (no longer) Works
holman
314
140k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None