Headers

A PE file contains several headers and the first one we encounter is the DOS header, which only contains two things that are interesting for us; the first is the MZ signature and the second is the offset of the file header, also known as the PE header (as it is preceded by the PEx0x0 signature). The file header contains basic information about the file such as, for example, the number of sections.

Following the PE header is the optional header, which, in turn, contains even more interesting information such as ImageBase, --the address at which the image (file) should preferably be loaded, --and NumberOfRvaAndSizes, and the latter is of special interest for us. The NumberOfRvaAndSizes field denotes the number of entries in the array of IMAGE_DATA_DIRECTORY entries immediately following the optional header. The IMAGE_DATA_DIRECTORY structure is defined as follows:

struct IMAGE_DATA_DIRECTORY
{
DWORD VirtualAddress;
DWORD Size;
}

Each of these structures describes certain areas of the PE file. For example, Import IMAGE_DATA_DIRECTORY, the one we are particularly interested in, refers to information about functions not present in this file, but imported from dynamic link libraries.

The next would be an array of IMAGE_SECTION_HEADER structures, where each of the PE sections is described (we are given a section's file offset and size as well as its virtual address and virtual size, the size in memory, which may and most likely will be different from its size in the file).

While I strongly encourage you to read the official specification, I would also suggest downloading and installing the best hex editor I have ever seen, --010 Editor (available at https://www.sweetscape.com/010Editor/). This powerful application, in addition to having builds for Windows, mac OS X, and Linux, supports templates for easier parsing of different binary formats and has a template for parsing of PE files. Take a look at the template's output; --it makes understanding the PE format much easier. Here is how a PE file is displayed in 010 Editor:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset