How can I create an executable .exe PE file manually?

Question

All texts on how to create a compiler stop after explaining lexers and parsers. They don\'t explain how to create the machine code. I want to understand the end-to-end process.<

Answer 1

Not surprisingly the best sites for information about writing PE format files are all about creating viruses.

A search of VX Heavens for "PE" gives a whole bunch of tutorials for modifying PE files

Answer 2

Iv'e used "Wotsit's File Format" for years... all the way back to the days of MS-Dos :-) and back to when it was just a collection of text files you could download from most BBS systems called "The Game programmers file type encyclopaedia"

It's now owned by the people that run Gamedev.Net, and probably one of the best kept secrets on the internet.

You'll find the EXE format on this page : http://www.wotsit.org/list.asp?fc=5

Enjoy.

UPDATE June 2020 - The link above seems to be now dead, I've found the "EXE" page listed on this web archive page of the wotsit site: https://web.archive.org/web/20121019145432/http://www.wotsit.org/list.asp?al=E

UPDATE 2 - I'm keeping the edit as it was when I added the update erlier, thanks to those who wanted to edit it, but it's for a good reason I'm rejecting it:

1) Wotsit.org may at some point in the future come back online, if you actually try visiting the url, you'll find that it's not gone, it does still respond, it just responds with an error message. This tells me that someone is keeping the domain alive for whatever reason.

2) The archive links do seem to be a bit jittery, some work, some don't, sometimes they seem to work, then after a refresh they don't work, then they do work again. I remember from experience when wotsit was still online, they they had some very strange download/linking detection code in, and this probably caused archive.org to get some very wierd results, I do remember them taking this stance because of the huge number of 3rd party sites trying to cash in on their success, by pretending to be affiliate's and then direct linking to wotsit from an ad infested site.

Until the wotsit domain is removed entirely from the internet and not even the DNS responds, then would be the time to wrap everything up into single archive links, until then, this is the best way to maintain the link.

Answer 3

Some information about making PE files as small as possible: Tiny PE.

The minimalistic way to mess around with code generation, if you're just looking to try a few simple things out, is to output MS-DOS .COM files, which have no header or metadata. Sadly, you'd be restricted to 16-bit code. This format is still somewhat popular for demos.

As for the instruction format, from what I recall the x86 instruction set is variable-length, including 1-byte instructions. RISC CPUs would probably have fixed-length instructions.

Answer 4

For Linux, one may read and run the examples from "Programming from the Ground Up" by Jonathan Bartlett:

http://www.cs.princeton.edu/courses/archive/spr08/cos217/reading/ProgrammingGroundUp-1-0-lettersize.pdf

Then of course one may prefer to hack Windows programs. But perhaps the former gives a better way to understand what really goes on.

Answer 5

Executable file format is dependent on the OS. For windows it is PE32(32 bit) or PE32+(64 bit).

The way the final executable look like depends on the ABI (application binary interface) of the OS. The ABI tells how the OS loader should load the exe and how it should relocate it, whether it is dll or plain executable etc..

Every object file(executable or dll or driver) contains a part called sections. This is where all of our code, data, jump tables etc.. are situated.

Now, to create an object file, which is what a compiler does, you should not just create the executable machine code, but also the headers, symbol table, relocation records, import/export tables etc..

The pure machine code generation part is completely dependent on how much optimized you want your code to be. But to actually run the code in the PC, you must have to create a file with all of the headers and related data(check MSDN for precise PE32+ format) and then put all of the executable machine code(which your compiler generated) into one of the sections(usually code resides in section called .text). If you have created the file conforming to the PE32+ format, then you have now successfully created an executable in windows.

Answer 6

As in many of his articles, I'd say Matt Pietrek's piece about PE internals remains the best introdction to the matter more than a decade after being written.