Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

[workshop] Exploring the Portable Executable fo...

Avatar for Ange Albertini Ange Albertini
September 13, 2013
Technology
570
0

[workshop] Exploring the Portable Executable format

44Con 2013
London, England

Avatar for Ange Albertini

Ange Albertini

September 13, 2013

More Decks by Ange Albertini

See All by Ange Albertini
Fearsome File Formats
Avatar for Ange Albertini ange
0
1.1k
Overview of file type identifiers
Avatar for Ange Albertini ange
0
1.6k
A question of time
Avatar for Ange Albertini ange
0
1.2k
SBuD: InfoVis in InfoSec
Avatar for Ange Albertini ange
1
1k
Generating Weird Files
Avatar for Ange Albertini ange
0
540
Technical challenges with file formats
Avatar for Ange Albertini ange
1
2.4k
Inside out - abusing archive file formats
Avatar for Ange Albertini ange
3
2k
Relations between archive formats
Avatar for Ange Albertini ange
0
2.5k
Beyond your studies v2
Avatar for Ange Albertini ange
2
1.1k

Other Decks in Technology

See All in Technology
日経電子版を支えていく Kasane Design System/fec_fukuoka
Avatar for 日本経済新聞社 エンジニア採用事務局 nikkei_engineer_recruiting
0
620
Screen Lens - 今見てる画面を翻訳する
Avatar for komagata komagata
0
230
Sigmaで作る業務アプリ
Avatar for kazushiro_honma kazushiro_honma
0
110
Omarchy Quattro の日本語設定周り
Avatar for Akira Shimosako simosako
2
140
リージョンの壁を越える、 ちょっと変わったAWSサービスの話
Avatar for Michael Tedder falken
PRO
1
300
プロダクト思考 × 基盤思考を AIで実現する Compound Engineering
Avatar for Watanabe Takeshi(Buzz) tkc66buzz
1
310
omasushiというライブラリを作った
Avatar for polidog polidog
PRO
0
190
Reactの設計論
Avatar for uhyo uhyo
14
7.7k
DEFCON34-Write-up_HYCu-MYCu
Avatar for okzkey daikiokazaki
0
140
『止めない』を設計する — 制約の中で、事業の根幹を支える判断
Avatar for Terry hiroyaterui
0
260
When Does a Local Qwen Start to Break
Avatar for Shoto morshoto
0
200
コーディングエージェントでM5Stack系の開発を少し試した時の話 / M5 Japan Tour 2026 Autumn 東京
Avatar for you（@youtoy） you
PRO
0
120

Featured

See All Featured
Prompt Engineering for Job Search
Avatar for Mfonobong Umondia mfonobong
0
450
Mobile First: as difficult as doing things right
Avatar for Swwweet swwweet
225
10k
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
SEO Brein meetup: CTRL+C is not how to scale international SEO
Avatar for Linda Hogenes lindahogenes
1
2.9k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
287
14k
Kristin Tynski - Automating Marketing Tasks With AI
Avatar for Tech SEO Connect techseoconnect
PRO
0
510
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
7.2k
Why Mistakes Are the Best Teachers: Turning Failure into a Pathway for Growth
Avatar for Umar Saidu Auna auna
0
270
Mozcon NYC 2025: Stop Losing SEO Traffic
Avatar for Sam Torres samtorres
1
520
Breaking role norms: Why Content Design is so much more than writing copy - Taylor Woolridge
Avatar for UX Y'all uxyall
1
400
世界の人気アプリ100個を分析して見えたペイウォール設計の心得
Avatar for Akihiro Kokubo akihiro_kokubo
PRO
74
42k

Transcript

  1. Exploring the Portable Executable format London, England Ange Albertini 2013/09/13

  2. Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider

  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None
  11. None
  12. None
  13. None
  14. None
  15. None

  16. a handmade PE simple.exe a first real example working minimal

  17. None
  18. None
  19. None

  20. detailed walkthrough

  21. None

  22. DOS header unused in PE mode

  23. None

  24. PE header PE signature

  25. None

  26. Optional Header NOT optional in executables

  27. None

  28. DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each

    entry interpreted differently
  29. None

  30. Sections memory mapping

  31. None
  32. None

  33. Imports standard loader mechanism NOT required load DLL, locate APIs

  34. None

  35. compiled PE compiled.exe closer to reality extra non-critical structure

  36. None
  37. None
  38. None

  39. DLL exports relocations

  40. None
  41. None

  42. driver subsystem, checksum low alignments mapping different imports

  43. None

  44. resources structure version, manifest/icon, APIs

  45. None
  46. None

  47. Thread Local Storage callback list before EntryPoint & after ExitProcess

  48. None

  49. .Net different and integrated binary 2nd loader

  50. None

  51. what about 64b? very few changes • 2 magic constants

    • a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)

  52. and ARM • a different magic constant • still 16b

    DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’

  53. trivial

  54. None
  55. None
  56. None
  57. None
  58. None