Well we all know what a PE is... many have not heard it called my this name, but the PE is the .exe you use to run applications on your computer. For example notepad.exe, winamp.exe etc... and kernel.dll, nero.dll are all PE's. They all follow a certain structure. Now such a valuable and reguarly used file format should be understood or at least tried ;)
So I'm going to show you the insides of a simple .exe... rip it to pieces until there's nothing left in there.
Okay now I had to choose an exe as an example... I was going to use notepad.exe but then I thought that it is a bit complex to start with, and I'll add it in later on. So to start with we'll compile and create our own exe and then we can see just where this code is in our PE file.
Now before I start telling you which bytes do what and what a section is and why I'm poor...lol... I'm going to break it up into little chapters that you can easily chew and digest. If I force it all on you in one big go it might kill you ;)
Chptr-1- PE File Format From A Distance.
Chptr-2- Start of a PE... our simple .exe
Chptr-3- FileHeader isnt' scary its our friend!
Chptr-4- More Headers (Optional or NOT)
Chptr-5- Sections ... our code.. we found you.
Chptr-6- Import Table.
Also feedback is welcome, so if you come across any errors please tell me. Again this information is for educational purposes, as I think its an piece of knowledge to know this... as you use exectuables all the time ... so it's interesting to know what is happening behind the scenes.
The theory of the PE format is fun and interesting - but to take things to the next level - I put together a set of tutorials and examples that use the NASM assembler to build/patch and look at the exe files in their raw format.
Hacking PE Files with NASM
|
