Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable format
Search
Ange Albertini
September 13, 2013
Technology
0
380
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
SBuD: InfoVis in InfoSec
ange
1
610
Generating Weird Files
ange
0
150
Technical challenges with file formats
ange
0
2k
Inside out - abusing archive file formats
ange
3
1.5k
Relations between archive formats
ange
0
1.6k
Beyond your studies v2
ange
1
790
Generating weird files
ange
0
3.2k
You are not an idiot
ange
1
2.5k
TimeCryption
ange
0
950
Other Decks in Technology
See All in Technology
SIEMを用いて、セキュリティログ分析の可視化と分析を実現し、PDCAサイクルを回してみた
coconala_engineer
0
280
web-application-security
matsuihidetoshi
0
130
NgRx Signal Store
rainerhahnekamp
0
140
生産性向上チームの紹介
cybozuinsideout
PRO
1
850
ユーザーストーリーのレビューを自動化したみたの
bun913
1
410
API Gatewayと少し仲良くなってみた!
masuchoku
0
100
コンパウンドスタートアップのためのスケーラブルでセキュアなInfrastructure as Codeパイプラインを考える / Scalable and Secure Infrastructure as Code Pipeline for a Compound Startup
yuyatakeyama
4
4.6k
サーバー間 GraphQL と webmock-graphql の話 / server-to-server graphql and webmock-graphql
qsona
2
180
KubeCon EU 2024 Recap “Kubernetes Policy Time Machine: Where to Next?”
ryysud
0
200
Delivering Millions of Messages within seconds @ Duolingo
pelelgrino
0
340
ChatGPT for IT Service Management (IT Pro)
dahatake
7
1.5k
SPI原点回帰論:事業課題とFour Keysの結節点を見出す実践的ソフトウェアプロセス改善 / DevOpsDays Tokyo 2024
visional_engineering_and_design
4
1.9k
Featured
See All Featured
For a Future-Friendly Web
brad_frost
172
9k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
14
1.5k
10 Git Anti Patterns You Should be Aware of
lemiorhan
648
58k
Thoughts on Productivity
jonyablonski
58
3.8k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
21
1.6k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
322
20k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
116
18k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
78
42k
Automating Front-end Workflow
addyosmani
1356
200k
A Modern Web Designer's Workflow
chriscoyier
689
190k
Gamification - CAS2011
davidbonilla
76
4.6k
Fashionably flexible responsive web design (full day workshop)
malarkey
398
65k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None