About PE File #2

About PE file #2

pyutic

1

PE file structureHeader

Real-Data

2

PE file structureHeader

Real-Data

DOS Header

NT Header

Section Header

Section Data

Section Data

Section Data

3

Offset? VA? RVA?

Offset

VA(Virtual Address)

ImageBase + RVA

RVA(Relative Virtual Address)

4

Header -DOS Header-

PE file can be used for ‘DOS OS’

DOS Header

DOS Stub NT Header

DOS! NO!

5

Header -DOS Header-

PE file can be used for ‘DOS OS’

DOS Header

DOS Stub

NT Header

6

Header -NT Header-

Many things are in here!

Machine

Sections Information

Characteristic

Entry Point

Image Base

SubSystem

Data Directory

7

Header -NT Header ~ Data Directory-

RVA & Size

Import Directory

Export Directory

Relocation Directory

Resource Directory

…

8

How packer works

9

Original Binary

Header

Section

Section

Section

How packer works

10

Original Binary

Header

Section #1

Section #2

Section #3

Packed Binary

Header

Section #1

Section #2

Section #3

How packer works -UPX-

11

Original Binary

How packer works -UPX-

12

After Packing

Why UPX0 is?

Thanks !pyutic@gmail.com

13