Upgrade to Pro — share decks privately, control downloads, hide ads and more …

[workshop] Exploring the Portable Executable fo...

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Ange Albertini Ange Albertini
September 13, 2013
Technology
530
0

[workshop] Exploring the Portable Executable format

44Con 2013
London, England

Avatar for Ange Albertini

Ange Albertini

September 13, 2013

More Decks by Ange Albertini

See All by Ange Albertini
Fearsome File Formats
Avatar for Ange Albertini ange
0
1k
Overview of file type identifiers
Avatar for Ange Albertini ange
0
1.4k
A question of time
Avatar for Ange Albertini ange
0
1.2k
SBuD: InfoVis in InfoSec
Avatar for Ange Albertini ange
1
950
Generating Weird Files
Avatar for Ange Albertini ange
0
470
Technical challenges with file formats
Avatar for Ange Albertini ange
1
2.3k
Inside out - abusing archive file formats
Avatar for Ange Albertini ange
3
2k
Relations between archive formats
Avatar for Ange Albertini ange
0
2.4k
Beyond your studies v2
Avatar for Ange Albertini ange
2
1.1k

Other Decks in Technology

See All in Technology
え！？初参加で 300冊以上 も頒布！？ これは大成功！そのはずなのに わいの財布は 赤字 の件
Avatar for hellohazime hellohazime
0
160
レビューしきれない？それは「全て人力でのレビュー」だからではないでしょうか
Avatar for amixedcolor amixedcolor
0
300
小説執筆のハーネスエンジニアリング
Avatar for osushi_cr yoshitetsu
0
400
Azure PortalなどにみるWebアクセシビリティ
Avatar for tomokusaba tomokusaba
0
390
データを"持てない"環境でのアノテーション基盤設計
Avatar for SansanTech sansantech
PRO
1
100
20260415_生成AIを専属DSに_自動レポート作成_ハンズオン_交通事故データ
Avatar for NobuakiOshiro doradora09
PRO
0
110
研究開発部メンバーの働き⽅ / Sansan R&D Profile
Avatar for Sansan, Inc. sansan33
PRO
4
23k
Oracle AI Database@AWS：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
4
2.3k
CloudSec JP #005 後締め ～ソフトウェアサプライチェーン攻撃から開発者のシークレットを守る～
Avatar for LHazy lhazy
0
230
"SQLは書けません"から始まる データドリブン
Avatar for kubell kubell_hr
2
470
Azure Speech で音声対応してみよう
Avatar for kosmosebi kosmosebi
0
160
Standards et agents IA : un tour d’horizon de MCP, A2A, ADK et plus encore
Avatar for Guillaume Laforge glaforge
0
130

Featured

See All Featured
We Are The Robots
Avatar for Honza Javorek honzajavorek
0
210
Designing Powerful Visuals for Engaging Learning
Avatar for Mike Taylor tmiket
1
340
Ethics towards AI in product and experience design
Avatar for Skipper Chong Warson skipperchong
2
250
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
141
35k
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
Avatar for Aleyda Solis aleyda
2
10k
The agentic SEO stack - context over prompts
Avatar for schlessera schlessera
0
740
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
304
21k
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
239
140k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
8k
Are puppies a ranking factor?
Avatar for Jono Alderson jonoalderson
1
3.3k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
128
55k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
290

Transcript

  1. Exploring the Portable Executable format London, England Ange Albertini 2013/09/13

  2. Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider

  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None
  11. None
  12. None
  13. None
  14. None
  15. None

  16. a handmade PE simple.exe a first real example working minimal

  17. None
  18. None
  19. None

  20. detailed walkthrough

  21. None

  22. DOS header unused in PE mode

  23. None

  24. PE header PE signature

  25. None

  26. Optional Header NOT optional in executables

  27. None

  28. DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each

    entry interpreted differently
  29. None

  30. Sections memory mapping

  31. None
  32. None

  33. Imports standard loader mechanism NOT required load DLL, locate APIs

  34. None

  35. compiled PE compiled.exe closer to reality extra non-critical structure

  36. None
  37. None
  38. None

  39. DLL exports relocations

  40. None
  41. None

  42. driver subsystem, checksum low alignments mapping different imports

  43. None

  44. resources structure version, manifest/icon, APIs

  45. None
  46. None

  47. Thread Local Storage callback list before EntryPoint & after ExitProcess

  48. None

  49. .Net different and integrated binary 2nd loader

  50. None

  51. what about 64b? very few changes • 2 magic constants

    • a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)

  52. and ARM • a different magic constant • still 16b

    DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’

  53. trivial

  54. None
  55. None
  56. None
  57. None
  58. None