portable-executable | 易学教程

Windows initial execution context

阅读更多关于 Windows initial execution context

问题 Once Windows has loaded an executable in memory and transfert execution to the entry point, do values in registers and stack are meaningful? If so, where can I find more informations about it? 回答1: Officially, the registers at the entry point of PE file do not have defined values. You're supposed to use APIs, such as GetCommandLine to retrieve the information you need. However, since the kernel function that eventually transfers control to the entry point did not change much from the old days

Where is the digital signature stored when code signing a exe file in windows?

阅读更多关于 Where is the digital signature stored when code signing a exe file in windows?

问题 As stated in the question title. However, I am using a "trick" where i store extra data after the executable to be used at runtime (see here). Signing my executable appears to break this 'trick' however, so my question is where is the signature stored in the exe (PE) file? I am usingsigntool from microsoft to sign my executable. 回答1: An embedded digital signature is always appended to the end of the executable file, whether or not you have custom data attached to it. The attached data is

PE Format - IAT Questions

阅读更多关于 PE Format - IAT Questions

问题 I'm trying to write an exe packer for windows. I've got some of the basics worked out so far. The part I'm up to though is reading the "BOUND IMPORT Directory Table" (or .idata section?), basically the section of the PE file that contains the list of DLLs that the loader needs to import. I'm wondering what the best way to either: [A] find out where the IAT is (because running PEView against a few different .exe's seems to show that this list can be contained in multiple different places) and

PE - Distinguish data from function export

阅读更多关于 PE - Distinguish data from function export

问题 I'm trying to find a way to figure out in IDA which exports are data exports and which are real functions export. For example, let's have a look at Microsoft's msftedit.dll's export entries: While CreateTextServices is a real exported function: IID_IRichEditOle is a data export and IDA fails to realize that, interpeting data as code: Do someone know a reliable way to distinguish the two? Help will be much appreciated. Thanks in advance. 回答1: There is no perfectly reliable way to do this for

What does the /TSAWARE linker flag do to the PE executable?

阅读更多关于 What does the /TSAWARE linker flag do to the PE executable?

After adding the /TSAWARE linker flag to one of my projects (Visual Studio 6), I was surprised to find a new section in the PE file (.idata). If I don't set the flag, the imports are merged into .rdata. To illustrate the "problem" we start out with a simple console program: #include <stdio.h> int main() { printf("hello world\n"); return 0; } and compile with: cl /Og /O1 /GF /WX /c main.c Then link with link /MACHINE:IX86 /SUBSYSTEM:CONSOLE /RELEASE /OUT:a.exe main.obj link /MACHINE:IX86 /SUBSYSTEM:CONSOLE /RELEASE /OUT:b.exe /TSAWARE main.obj Let's compare the dumpbin output: Dump of file a

What is “Alignment” field in binary formats? Why is it needed?

阅读更多关于 What is “Alignment” field in binary formats? Why is it needed?

In ELF file format we have an Alignment field in Segment Header Table aka Program Header Table . In case of Windows PE file format they take it to next level the Sections have two alignment values, one within the disk file and the other in memory. The PE file header specifies both of these values. I didn't understand a thing about this alignment. What do we need it for? How & Where is it used? Again, I don't know what is alignment in binary file format context but why do we need it? Well, alignment is usually stretching the storage size of some value to occupy some "round" space, like 32, 64,

PE format, what is the use for IAT Directory

阅读更多关于 PE format, what is the use for IAT Directory

In the PE format we have Import Table Directory (accessed by IMAGE_DIRECTORY_ENTRY_IMPORT ) and IAT Directory (accessed by IMAGE_DIRECTORY_ENTRY_IAT ) both are part of the Optional Header Data Directory. Using the Import Table, the loader dynamically loads and resolves necessary libraries and functions. This is done by iterating through the Import Address Table RVA (Thunk Table) which is part of the Import Table. So, if we use the import directory for import resolution what do we need IAT Directory for ? I've been reading the Microsoft PE specification but couldn't find an answer. Also, there

How do I read the PE header of a module loaded in memory?

阅读更多关于 How do I read the PE header of a module loaded in memory?

I'm experimenting with memory access in .NET. At the moment, I have a managed program that starts an unmanaged process and retrieves the BaseAddress of one of its loaded modules (a DLL). What I would like to do is somehow read the PE header of the loaded module so that I can later retrieve the addresses of its exports. Unfortunately, I can't find any good information about this. Any ideas? This is a good starting point for the PE file format. You can P/Invoke ReadProcessMemory from the base address you have to copy the headers into your process. You'll need to parse the memory you read into

How can I read the headers from a WinNT portable executable file using Perl?

阅读更多关于 How can I read the headers from a WinNT portable executable file using Perl?

问题 I want to work with PE files in Perl and didn't find a module, so I think I will write my own (already did that in delphi once). I only got one problem, when mapping the executable to a buffer, how can i search for octals like 0x00004550 (IMAGE_NT_SIGNATURE), convert them back to writeable strings etc? 回答1: There is a Perl module to manipulate portable executables: Win32::Exe. I don't have a clue on your exact question, but if you still want to write your own library, Win32::Exe might be a

Where can I find a reference for what every bit of the CorFlags value means?

阅读更多关于 Where can I find a reference for what every bit of the CorFlags value means?

问题 I'm messing around with some rather low level things and trying to determine why I get different outputs with the CorFlags.exe utility. For reference, the outputs are as so: $ corflags test2.exe Microsoft (R) .NET Framework CorFlags Conversion Tool. Version 4.0.30319.17929 Copyright (c) Microsoft Corporation. All rights reserved. Version : v4.0.30319 CLR Header: 2.5 PE : PE32 CorFlags : 0x1 ILONLY : 1 32BITREQ : 0 32BITPREF : 0 Signed : 0 $ corflags test.exe Microsoft (R) .NET Framework