15
By Saurabh & Chinmaya

PE File Format

Embed Size (px)

DESCRIPTION

PE File Format by Saurabh & Chinmaya @ null Banglore Meet, October 2010

Citation preview

Page 1: PE File Format

By Saurabh & Chinmaya

Page 2: PE File Format

Definition

The Portable Executable (PE) format is a file

format for executables, object code, and

DLLs, used in 32-bit and 64-bit versions of

Windows operating systems.

The term "portable" refers to the format's

versatility in numerous environments of

operating system software architecture.

Page 3: PE File Format

Basic Structure

•Executable Code Section,

named .text (Microsoft) or CODE

(Borland)

•Data Sections, named .data,

.rdata, or .bss (Microsoft) or

DATA (Borland)

•Resources Section, named .rsrc

•Export Data Section, named

.edata

•Import Data Section, named

.idata

•Debug Information Section,

named .debug

Page 4: PE File Format

Mapping Into Memory

Page 5: PE File Format

Tools Of Trade

Lord PE

PEid

PEView

OllyDbg

Page 6: PE File Format

DOS ‘MZ’ Header

64 Byte Header

First two bytes of DOS header contain the value 4Dh, 5Ah (The letters "MZ" for Mark Zbikowsky one of the original architects of MS-DOS) which signifies a valid DOS header.

Last 4 bytes point towards PE Header

Page 7: PE File Format

DOS Stub

If the program is run from DOS, DOS can recognize it as a valid executable and run the DOS stub which is stored immediately after the header.

The DOS stub usually just prints a string something like "This program must be run under Microsoft Windows" but it can be a full-blown DOS program.

When building an application for Windows, the linker links a default stub program called WINSTUB.EXE into the executable. We can override the default linker behavior by substituting your own valid MS-DOS-based program in place of WINSTUB and using the -STUB: linker option when linking the executable file.

Page 8: PE File Format

PE File Header

Also called as Image_NT_Header

Consists of

Signature

Image_File_Header

Image_Optional_Header

Page 9: PE File Format

Signature

4 bytes (Dword) Signature

Value is ‘00004550’ representing

characters ‘PE’

Page 10: PE File Format

Image File Header

20 bytes header

Starting Byte Type Information

1 WORD Machine

3 WORD Number of sections

5 DWORD Time Date stamp

9 DWORDPointer to symbol

table

13 DWORD Number of symbols

17 WORDSize of optional

header

19 WORD Characteristics

Page 11: PE File Format

Optional Header

It contains following important fields:

Address Of Entry Point

Image Base

Section Alignment

File Alignment

Subsystem

Data directory

○ An array of 16 IMAGE_DATA_DIRECTORY structures, each relating to an important data structure in the PE file such as the import address table etc.

Page 12: PE File Format

Image_Section_Header

It contains information about various

sections.

It contains following important fields

Name of section

Relative Virtual Address (RVA)

Virtual Size

Characteristics of Section

Page 13: PE File Format

Sections

.text

• Contains the executable code

• Also known as .code

.data• Contains initialized data

.reloc

• Contains relocation information

Page 14: PE File Format

Sections

.rsrc

• Contains resource information of a module

.debug

• Contains debug information

.edata,.

idata

• Contains export and import data

Page 15: PE File Format

Thank You