Upgrade to Pro — share decks privately, control downloads, hide ads and more …

[workshop] Exploring the Portable Executable fo...

Avatar for Ange Albertini Ange Albertini
September 13, 2013
Technology
0
480

[workshop] Exploring the Portable Executable format

44Con 2013
London, England
Avatar for Ange Albertini

Ange Albertini

September 13, 2013
Tweet

More Decks by Ange Albertini

See All by Ange Albertini
Fearsome File Formats
Avatar for Ange Albertini ange
0
800
Overview of file type identifiers
Avatar for Ange Albertini ange
0
1.1k
A question of time
Avatar for Ange Albertini ange
0
1.1k
SBuD: InfoVis in InfoSec
Avatar for Ange Albertini ange
1
850
Generating Weird Files
Avatar for Ange Albertini ange
0
370
Technical challenges with file formats
Avatar for Ange Albertini ange
1
2.2k
Inside out - abusing archive file formats
Avatar for Ange Albertini ange
3
1.9k
Relations between archive formats
Avatar for Ange Albertini ange
0
2.1k
Beyond your studies v2
Avatar for Ange Albertini ange
2
980

Other Decks in Technology

See All in Technology
エンジニアリングで組織のアウトカムを最速で最大化する！
Avatar for ham ham0215
1
290
クラウドネイティブ環境の脅威モデリング
Avatar for Kyohei Mizumoto kyohmizu
1
370
GraphQLを活用したリアーキテクチャに対応するSLI/Oの再設計
Avatar for coconala_engineer coconala_engineer
0
200
Datadog のトライアルを成功に導く技術 / Techniques for a successful Datadog trial
Avatar for 株式会社ヌーラボ nulabinc
PRO
0
120
Twelve-Factor-Appから学ぶECS設計プラクティス/ECS practice for Twelve-Factor-App
Avatar for k-ozawa ozawa
3
160
フルカイテン株式会社 エンジニア向け採用資料
Avatar for FULL KAITEN fullkaiten
0
5.5k
Serverlessだからこそコードと設計にはこだわろう
Avatar for Ken'ichirou Kimura kenichirokimura
2
530
本当に必要なのは「QAという技術」だった！試行錯誤から生まれた、品質とデリバリーの両取りアプローチ / Turns Out, "QA as a Discipline" Was the Key!
Avatar for ar_tama ar_tama
9
2.9k
2025年8月から始まるAWS Lambda INITフェーズ課金/AWS Lambda INIT phase billing changes
Avatar for quiver quiver
1
660
Azure Maps Visual in PowerBIで分析しよう
Avatar for なかしょ nakasho
0
200
時間がないなら、つくればいい 〜数十人規模のチームが自律性を発揮するために試しているいくつかのこと〜
Avatar for KAKEHASHI kakehashi
PRO
21
4.5k
日経電子版 for Android の技術的課題と取り組み(令和最新版)/android-20250423
Avatar for 日本経済新聞社 エンジニア採用事務局 nikkei_engineer_recruiting
2
640

Featured

See All Featured
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
42
7.5k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
200k
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
183
22k
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
91
6k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
344
40k
Making Projects Easy
Avatar for Brett Harned brettharned
116
6.2k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
56
9.3k
Documentation Writing (for coders)
Avatar for Carmen Chung carmenintech
71
4.8k
Fontdeck: Realign not Redesign
Avatar for Paul Robert Lloyd paulrobertlloyd
84
5.5k
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
38
1.7k
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
187
11k

Transcript

  1. Exploring the Portable Executable format London, England Ange Albertini 2013/09/13

  2. Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider

  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None
  11. None
  12. None
  13. None
  14. None
  15. None

  16. a handmade PE simple.exe a first real example working minimal

  17. None
  18. None
  19. None

  20. detailed walkthrough

  21. None

  22. DOS header unused in PE mode

  23. None

  24. PE header PE signature

  25. None

  26. Optional Header NOT optional in executables

  27. None

  28. DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each

    entry interpreted differently
  29. None

  30. Sections memory mapping

  31. None
  32. None

  33. Imports standard loader mechanism NOT required load DLL, locate APIs

  34. None

  35. compiled PE compiled.exe closer to reality extra non-critical structure

  36. None
  37. None
  38. None

  39. DLL exports relocations

  40. None
  41. None

  42. driver subsystem, checksum low alignments mapping different imports

  43. None

  44. resources structure version, manifest/icon, APIs

  45. None
  46. None

  47. Thread Local Storage callback list before EntryPoint & after ExitProcess

  48. None

  49. .Net different and integrated binary 2nd loader

  50. None

  51. what about 64b? very few changes • 2 magic constants

    • a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)

  52. and ARM • a different magic constant • still 16b

    DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’

  53. trivial

  54. None
  55. None
  56. None
  57. None
  58. None