About PE File #2
13
About PE file #2 pyutic 1
-
Upload
kim-dongju -
Category
Technology
-
view
45 -
download
2
Transcript of About PE File #2
About PE file #2
pyutic
1
PE file structureHeader
Real-Data
2
PE file structureHeader
Real-Data
DOS Header
NT Header
Section Header
Section Data
Section Data
Section Data
3
Offset? VA? RVA?
Offset
VA(Virtual Address)
ImageBase + RVA
RVA(Relative Virtual Address)
4
Header -DOS Header-
PE file can be used for ‘DOS OS’
DOS Header
DOS Stub NT Header
DOS! NO!
5
Header -DOS Header-
PE file can be used for ‘DOS OS’
DOS Header
DOS Stub
NT Header
6
Header -NT Header-
Many things are in here!
Machine
Sections Information
Characteristic
Entry Point
Image Base
SubSystem
Data Directory
7
Header -NT Header ~ Data Directory-
RVA & Size
Import Directory
Export Directory
Relocation Directory
Resource Directory
…
8
How packer works
9
Original Binary
Header
Section
Section
Section
How packer works
10
Original Binary
Header
Section #1
Section #2
Section #3
Packed Binary
Header
Section #1
Section #2
Section #3
How packer works -UPX-
11
Original Binary
How packer works -UPX-
12
After Packing
Why UPX0 is?
