Hello everyone. 1
One of video of expert mother announces in reverse engineering course in this video we will dive further 2
into some of the more detailed sections of AP fine. 3
So if you'll recall from our previous video they looked at this high level simplified diagram of a PE 4
file how the headers and sections look like so in the headers if you see we have four different parts. 5
The DOS header, the PE header, the optional header and the section stable. 6
So in this particular video, we are going to look closer into the optional header and the section 7
header. 8
We have already understood pretty much how the dos and the PE headers look like. To understand it 9
I want to use a very interesting diagram that is present on Wikipedia. 10
Here is the link to the diagram. I have also provided that link in the description/resource section of this video. 11
If you look at this diagram on the browser it is probably one of the best diagrams that you can find 12
about portable executable files. 13
So let me expand it a little bit. 14
So if you look at this diagram, it pretty much starts with the DOS header that is the standard signature of a exe 15
file which is 5A4D and then you have the DOS stub which consists of this program cannot run 16
into DOS mode. 17
Pretty much the standard stuff which we covered in the previous video. 18
Then we have the signature of the PE file which is 50 45 00 00. 19
Then you have the machine information number of sections and stuff like that. 20
So this was something which we had already covered in the previous section. 21
Now going forward we want to spend some time on the other sections of the file format as well so you 22
can see here the yellow part. 23
This is basically the standard COFF fields. 24
So again if you remember our discussion from the previous video we mentioned that all the executable 25
file formats are built on top of the COFF file format which is the compound object file formats. 26
So this is what this diagram actually proves. 27
You have the COFF format 28
And on top of it you have the PE file format bundled on it to create an executable format for the windows 29
environment. 30
So this is how a standard file format is used to create proprietary formats for different 31
kinds of operating systems. If you look at the standard COFF fields, you have to magic which basically 32
tells whether it's 32 bit or 64 bit executable operating system then you have this isolated code section. 33
Then you have the size of initializing data the amount of size that initialized executable will use and 34
on Uninitialized data size. Then you have the address of entry point. 35
So address of entry point is the address where the windows loader will begin execution. 36
This is basically a virtual address which tells windows loader 37
This is the location from where 38
The windows at this particular executable has to be run. Consider it as an entry point. 39
will load and executable in a debugger This is the location where the debugger will basically come and 40
halt to. 41
It might sound a little bit crazy right now but yeah as we move forward with our PEfile analysis, all 42
these sections will make a lot of sense. We then have base of code and base of data image based section 43
alignments and a lot of other fields like the operating system version. 44
So this basically tells which operating systems are supported for this PE file. We have the image version 45
as well then the subsystem versions. 46
So if you see here all these fields are very specific to the Windows environment. 47
So these sections can be specifically populated if you want to restrict the exe to run on certain 48
versions of windows and things like that. 49
So if you've come down to the data directories, you have some interesting fields again the export table 50
is basically 51
a table of export it functions. 52
Then you have import table which is a table of import functions. 53
The resources that are used by the exe and then you have the exceptions table. 54
So if you want to have certain exceptions which are very particular to the executable they can be defined 55
in this particular area. 56
Then you have certificate related information. 57
So whenever you sign a binary you can basically extract the certificate related information from this 58
particular section of the PE file. 59
You have debug related information, architecture data, config data. 60
Then you have input address tables. import Address table(IAT) is something which stores the runtime address 61
of imported functions. 62
So if you want to if you want to use any any windows specific function then it's address has to 63
be defined in the IAT. 64
The import actress.We will be working on import address table in quite a detail as you move into the other 65
sections of malware analysis of the files. 66
So that's about the data directories. 67
and in the end you have the sections table 68
so the section table contains information related to the various sections available in the image 69
of an executable file. 70
The sections in the image are sorted by the relative virtual addresses rather than alphabetically. 71
So here you can get information about the virtual size the virtual address and other important details 72
of the section of the PE file. 73
So there are a lot of different fields inside the header of PE file or inside a PE structure. 74
you basically have to spend time on each of them to really understand what they mean. 75
So coming back to our PPT Let's now jump to a demo. If you remember the previous example we used to 76
CFF explorer to basically look at the hex representation of a PE file where we looked at the 77
different sections of the MZ header, the DOS stub and the PE signatures. 78
So let us look at other information which CFF explorer provides us. 79
So if you start looking here you have information like the DOS header that is something which we looked 80
at then we have the NT header, file header and then the optional header. In the optional header you'll 81
see all those sections which we just saw in the previous diagram on wikipedia so you can see here you 82
have the magic bytes, the major Linker version, the minor version, size of code, address of entry point, 83
base of code, image section. So all these sections are the same which we looked at 84
in the previous image. 85
So if you see here what CFF explorer did was it basically parsed all those sections of the PE file 86
and extracted the offset values and added it over here. 87
So this is how these security tools understand the nature of a PE file or the properties of a PE file. 88
So that was my whole motive to help you understand the P E structure so that you can really make more 89
sense of all these values that have been added here. 90
So you have the data directories. 91
So if I bring you back to this example the data directory is this particular part 92
So those are the values that you will see here. 93
The real relative virtual address, you have the export directory, import directory, addresses so everything 94
that is RVA is basically a relative virtual address. 95
We will see in more detail in our next video what exactly are RVA means. 96
So you have then this section headers. 97
So if you come to the section headers here you will see all the other sections of the PE file which contains 98
the other data which is important for the PE file. 99
So so what happens is in the PE file you have this structure and after the structure, you have a bunch of 100
sections which contain other relevant properties of thePE file. For example the text section is normally 101
the first section and contains the executable code for the applications all the executable properties 102
of the PE file are present in the text section. The data section contains the initialize data of an 103
application such as strings and stuff like that. 104
So whatever value you're initializing in the PE file is stored in the data section. the rdata section 105
is basically a name that is used for import tables that are located in the 106
PE file and at the end, you have the rsrc file. The resource section which is a common name for the resource 107
container section which contains things like images or other such additional properties that you are 108
using inside the PE file. So you want to look at another example of 010 editor which is very much similar 109
to this particular example. 110
So if you load up PE file in 010 Editor, it's a pretty neat hex editor and it has a bunch of templates to 111
parse different file formats. It has executable file format templates as well. 112
So if you load an executable file and if you run the template it basically analyzes 113
all these sections and populate all the section values over here. Very similar to how CFF explorer 114
does it. 115
I just wanted to show you another tool so that you have one example that you can refer later. 116
So if you see here it has the MZ signature then it has the size then if you keep moving down you have 117
the DOS header over here then if you keep moving down you have these NT headers. 118
So this particular section 2 This is where our optional header lies. 119
So if you expanded you will see that you have the optional headers. If you expand the optional headers you will 120
start seeing all those same values which we just looked at in CFF explorer and Wikipedia 121
diagram. 122
So yeah the major Linker version, minor linker version, the size of code, base of code and things like that. 123
So if you understand how PE file format looks like you can pretty much make sense of all this data. 124
So this was all about the PE file's structure. 125
There will be just one more video on PE files and that will be our last video and that will basically 126
give you a good idea of what happens when you execute a file in a Windows environment. 127
Thanks for watching.