Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[workshop] Exploring the Portable Executable fo...
Search
Ange Albertini
September 13, 2013
Technology
0
510
[workshop] Exploring the Portable Executable format
44Con 2013
London, England
Ange Albertini
September 13, 2013
Tweet
Share
More Decks by Ange Albertini
See All by Ange Albertini
Fearsome File Formats
ange
0
900
Overview of file type identifiers
ange
0
1.2k
A question of time
ange
0
1.1k
SBuD: InfoVis in InfoSec
ange
1
900
Generating Weird Files
ange
0
420
Technical challenges with file formats
ange
1
2.3k
Inside out - abusing archive file formats
ange
3
1.9k
Relations between archive formats
ange
0
2.2k
Beyond your studies v2
ange
2
1k
Other Decks in Technology
See All in Technology
社内報はAIにやらせよう / Let AI handle the company newsletter
saka2jp
8
1.3k
OCI Network Firewall 概要
oracle4engineer
PRO
1
7.8k
AI時代だからこそ考える、僕らが本当につくりたいスクラムチーム / A Scrum Team we really want to create in this AI era
takaking22
7
4k
オープンソースでどこまでできる?フォーマル検証チャレンジ
msyksphinz
0
120
そのWAFのブロック、どう活かす? サービスを守るための実践的多層防御と思考法 / WAF blocks defense decision
kaminashi
0
120
ガバメントクラウド(AWS)へのデータ移行戦略の立て方【虎の巻】 / 20251011 Mitsutosi Matsuo
shift_evolve
PRO
2
180
Why Governance Matters: The Key to Reducing Risk Without Slowing Down
sarahjwells
0
120
ガバメントクラウドの概要と自治体事例(名古屋市)
techniczna
2
210
Wasmのエコシステムを使った ツール作成方法
askua
0
100
大規模サーバーレスAPIの堅牢性・信頼性設計 〜AWSのベストプラクティスから始まる現実的制約との向き合い方〜
maimyyym
5
3.6k
Modern_Data_Stack最新動向クイズ_買収_AI_激動の2025年_.pdf
sagara
0
230
「AI駆動PO」を考えてみる - 作る速さから価値のスループットへ:検査・適応で未来を開発 / AI-driven product owner. scrummat2025
yosuke_nagai
3
800
Featured
See All Featured
Rails Girls Zürich Keynote
gr2m
95
14k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
27k
Art, The Web, and Tiny UX
lynnandtonic
303
21k
The Power of CSS Pseudo Elements
geoffreycrofte
79
6k
Building Better People: How to give real-time feedback that sticks.
wjessup
368
20k
Build your cross-platform service in a week with App Engine
jlugia
232
18k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
45
2.5k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.5k
The World Runs on Bad Software
bkeepers
PRO
71
11k
What's in a price? How to price your products and services
michaelherold
246
12k
For a Future-Friendly Web
brad_frost
180
9.9k
Transcript
Exploring the Portable Executable format London, England Ange Albertini 2013/09/13
Workshop package (PoCs+docs) http://www.xchg.info/corkami/workshop.zip Recommended PE viewer: http://icerbero.com/peinsider
None
None
None
None
None
None
None
None
None
None
None
None
None
a handmade PE simple.exe a first real example working minimal
None
None
None
detailed walkthrough
None
DOS header unused in PE mode
None
PE header PE signature
None
Optional Header NOT optional in executables
None
DataDirectories end of OptionalHeader 16 (max) * [RVA, Size] each
entry interpreted differently
None
Sections memory mapping
None
None
Imports standard loader mechanism NOT required load DLL, locate APIs
None
compiled PE compiled.exe closer to reality extra non-critical structure
None
None
None
DLL exports relocations
None
None
driver subsystem, checksum low alignments mapping different imports
None
resources structure version, manifest/icon, APIs
None
None
Thread Local Storage callback list before EntryPoint & after ExitProcess
None
.Net different and integrated binary 2nd loader
None
what about 64b? very few changes • 2 magic constants
• a few elements become QWord ◦ ImageBase, Imports thunks, callbacks • Exceptions have their own DataDirectory ◦ no need for LoadConfig (SafeSEH)
and ARM • a different magic constant • still 16b
DOS Stub ! • nothing special, PE wise ◦ the beauty of ‘Portability’
trivial
None
None
None
None
None