Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
490
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
830
Overview of file type identifiers
ange
0
1.1k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
870
Generating Weird Files
ange
0
390
Technical challenges with file formats
ange
1
2.2k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
CI/CD/IaC 久々に0から環境を作ったらこうなりました
kaz29
1
200
KubeCon + CloudNativeCon Japan 2025 Recap
ren510dev
1
310
Amazon S3標準/ S3 Tables/S3 Express One Zoneを使ったログ分析
shigeruoda
6
600
SpringBoot x TestContainerで実現するポータブル自動結合テスト
demaecan
0
130
Connect 100+を支える技術
kanyamaguc
0
160
KubeCon + CloudNativeCon Japan 2025 Recap Opening & Choose Your Own Adventureシリーズまとめ
mmmatsuda
0
240
OPENLOGI Company Profile for engineer
hr01
1
33k
Flutter向けPDFビューア、pdfrxのpdfium WASM対応について
espresso3389
0
110
製造業からパッケージ製品まで、あらゆる領域をカバー!生成AIを利用したテストシナリオ生成 / 20250627 Suguru Ishii
shift_evolve
PRO
1
160
GitHub Copilot の概要
tomokusaba
1
150
AWS テクニカルサポートとエンドカスタマーの中間地点から見えるより良いサポートの活用方法
kazzpapa3
3
620
生成AI時代 文字コードを学ぶ意義を見出せるか?
hrsued
1
750
Featured
See All Featured
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
130
19k
Adopting Sorbet at Scale
ufuk
77
9.4k
Documentation Writing (for coders)
carmenintech
72
4.9k
Producing Creativity
orderedlist
PRO
346
40k
Statistics for Hackers
jakevdp
799
220k
Git: the NoSQL Database
bkeepers
PRO
430
65k
GraphQLの誤解/rethinking-graphql
sonatard
71
11k
Testing 201, or: Great Expectations
jmmastey
42
7.6k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
252
21k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
34
3.1k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Designing Experiences People Love
moore
142
24k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None