PE Format
In general modern Windows binaries are arranged like this diagram
PE32 is the 32-bit version of this file format
PE32+ is the 64-bit version, sometimes people write PE64
MS-DOS Header
We'll go over Windbg later in the semester
- Mostly irrelevant to us
- e_magic should be 0x4D5A
- e_lfanew is the relative virtual address (RVA) of the NT Header
Why would we not care about most of this?
Virtual Address?
This is not related to the concept of virtual addressing in relation to memory mangement
When a PE is loaded into memory, all virtual addressing is based on that load address
Virtual Addressing will use this address as it's base for this specific loaded instance of chrome
NT Header
Which parts do you think are important?
NT Header
Let's see what the official docs say about this one
When reversing Windows, in general, Microsoft has very good documentation
Image Data Directory
Not much to go off just looking at the struct
Official Docs are our friend again...
This won't always be the case, especially when you're trying to do unintended things or call undocumented API's
Finding Executable Sections
How do we find sections? We only know how many there are from looking at the Image File Header
The Image Section Header Struct is directly after the Image Optional Header
This tells us if it's executable (and other stuff aswell)
CFF Explorer
Allows us to browse through the PE file easily
Can also edit header fields with this tool
Good for rapid triage of a windows file