Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
490
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
840
Overview of file type identifiers
ange
0
1.1k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
870
Generating Weird Files
ange
0
390
Technical challenges with file formats
ange
1
2.2k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
Oracle Database@Google Cloud:サービス概要のご紹介
oracle4engineer
PRO
0
100
本が全く読めなかった過去の自分へ
genshun9
0
900
Zero Data Loss Autonomous Recovery Service サービス概要
oracle4engineer
PRO
2
7.7k
ゼロからはじめる採用広報
yutadayo
2
460
AIとともに進化するエンジニアリング / Engineering-Evolving-with-AI_final.pdf
lycorptech_jp
PRO
0
160
生成AI時代の開発組織・技術・プロセス 〜 ログラスの挑戦と考察 〜
itohiro73
1
430
20250707-AI活用の個人差を埋めるチームづくり
shnjtk
4
3.6k
Tech-Verse 2025 Global CTO Session
lycorptech_jp
PRO
0
1.7k
「クラウドコスト絶対削減」を支える技術—FinOpsを超えた徹底的なクラウドコスト削減の実践論
delta_tech
4
140
AIの全社活用を推進するための安全なレールを敷いた話
shoheimitani
2
430
面倒な作業はAIにおまかせ。Flutter開発をスマートに効率化
ruideengineer
0
200
Operating Operator
shhnjk
1
510
Featured
See All Featured
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
30
2.1k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
48
2.9k
Visualization
eitanlees
146
16k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.4k
Art, The Web, and Tiny UX
lynnandtonic
299
21k
Bootstrapping a Software Product
garrettdimon
PRO
307
110k
Rails Girls Zürich Keynote
gr2m
94
14k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
667
120k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Navigating Team Friction
lara
187
15k
Faster Mobile Websites
deanohume
307
31k
Testing 201, or: Great Expectations
jmmastey
42
7.6k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None