Hello everyone. 1
Welcome to the last video about the PE files. 2
So the first two videos we spend time on understanding the structure of PE files looking at different 3
sections and really understanding how exactly a PE file looks like, what is it consisting of and how to 4
make sense of different sections or different attributes which are present inside the headers of a PE 5
file. 6
So I just wanted to quickly go through another video to help you understand what happens when you execute 7
a program inside an operating system. 8
Let us for simplicity consider Windows operating system. 9
So what happens when a program is executed. 10
So when you run the binary the shell picks up the information and it tells the p e file loader to run 11
the file. 12
So for every different file format operating systems have different file loaders. 13
So because in this case we are talking about PE files. 14
So the shell informs the PE loader to run the file. The kernel then allocates virtual memory from the pool 15
to fit the binaries image inside it. 16
So if you remember when we were talking about import address tables and other virtual address spaces 17
in our previous video, we used term relative virtual address or virtual address. 18
So I'll quickly help you understand what exactly virtual address means. 19
So there are two types of memories on your operating system. 20
One is the hard disk which is your local storage and the other one is your RAM or the random access 21
memory which is a volatile dynamic memory. 22
So when PE file is sitting on the disk it's basically saved on the local hard disk. 23
When you run it the operating system allocates a virtual address space in which the program can run. 24
So this is basically an optimization that the operating system implements in order to make sure that 25
the operating system allocates enough memory for an executable to really run. If let's say you're 26
running a program you do not want to continuously add more and more space to it you just want to allocate 27
it a wide space so that it can stay where they're run as long as it is alive. 28
And once you close that operating system once you close that executable, the operating system just flushes 29
that memory out and they file still exists on the disk. 30
So this is how memory management happens inside the operating system. 31
When the file is sitting on the disk, it's basically having a local 32
address space and when it is executed it has a virtual memory space in the random access memory. 33
So what the kernel does is that it basically allocates the virtual memory for the executable to load 34
it then loads it in that particular memory section. Then what happens is, the loader 35
starts parsing the different sections of the PE file to start making sense out of it. 36
I'm referring to the same sections which we talked about in the previous videos. 37
If you remember we talked about the Import address table (IAT). 38
So what the import address table contains is the information about all the import functions that the 39
executable wants to use. 40
So you might be familiar with DLLs in Windows operating system which is a dynamic link libraries. 41
So DLLs are nothing but executable codes and functions which can be reused by any program running 42
on the Windows operating system. 43
So DLLs are the classic examples of code reuse. 44
You basically create all this dynamic like libraries and you let any other executable use them on demand. 45
For example if let's say you want to load a video inside your application then you do not have to write 46
the entire program to create that movie file, create that player media player where it should be 47
loaded and stuff like that. 48
All you can do is you can simply import the Windows DLLs which are responsible for running a video 49
file on the operating system. 50
You can just import them inside your code and you can use them to quickly launch any video inside your 51
file. 52
You do not have to write that same code again and again. 53
Another example can be let's say if you want to establish a network connection, you just don't have to 54
write the entire code. 55
You can use the windows DLL libraries which are responsible for setting up these socket connections, 56
establishing the connection, doing the handshakes and stuff like that and the operating system basically 57
takes care of all those things. 58
So that's the major advantage of using DLLs. So every executable that is there on the windows machine 59
they will be using some of the other forms of the DLLs because they all rely on certain properties 60
of the operating system to run to execute and do whatever behavior they want to do on the OS(operating system).. 61
So the information of all those DLLs is basically contained in the import address table. 62
So as we move ahead with our other videos, import address tables(IAT) will play a key role in understanding 63
the behavior of an operating system, what kind of properties does that operating does that executable 64
contain. 65
Because we all know what DLLs can be used to perform what kind of tasks. 66
So we can immediately guess that okay this particular executable wants to 67
connect to Internet, this particular executable it wants to launch the shell prompt and perform certain 68
commands inside it. 69
This particular executable is trying to launch power shell and stuff like that so it becomes slightly 70
easy to really understand what are the actual behaviors of the executable file. 71
So moving to the second part. What happens is that the PE loader once it has populated the import address 72
table with the addresses of all the DLLs which are there in their memory it will start recursively 73
passing through all those symbol functions, locating them in the memory, and assigning it to the executable. 74
The standard process about how an operating system loads a process into the memory. 75
The kernel then pushes the current location into an execution stack. 76
So for example what happens is when you are executing a certain section of the code and all of a sudden 77
you call a DLL which says that okay play the movie. 78
So the command has to now jump from your section to another memory section where that DLL is loaded. 79
So what the kernel does is that it stores the current execution location on the stack jumps on to the 80
Dll's memort location. 81
The alleged memory location execute the DLL, then come back to the same place where it had last executed 82
your binary and then start this step instructions again. 83
So this is how kernel does a memory mapping of your executable with other linked libraries that are 84
that you are using from the windows operating system. 85
So the kernel basically pushes the current location into an execution stack so that it knows where to 86
come back to it then jumps from the current memory to the shared memory location where the DL is loaded 87
executes it performs the action then pops the memory from the stack and returns back to begin the further 88
execution of your program. 89
So once the execution is complete the kernel just deletes all the virtual space that he had created for 90
the executable. 91
And this is how a program basically gets executed inside the operating system a very high level overview 92
of how a program would run inside an operating system. 93
I would highly encourage that. 94
You can go ahead and read more about a lot of interesting operating system concepts like segmentation 95
and paging and lot of other stuff related to dynamic linking libraries how operating system manages 96
memory and stuff like that. 97
Those are really really interesting computer science concepts. 98
So at last. 99
This is a very simple representation of what we just talked about. 100
So if you look at the first point, it says that running program gets its own area in RAM which 101
is our virtual memory to hold the code and the data so everything that was there inside the executable 102
gets written onto the RAM and then the CPU basically executes all those instructions one by one. 103
Doing all these memory management, linking with these shared libraries, executing them coming back and 104
stuff like that so that's how a program gets executed in the memory. 105
So this was all about understanding the basic behavior of P files and structures and how an operating 106
system looks at a PE file. 107
So going forward we'll start looking into specific cases of static malware analysis and then we look 108
at a look at different cases about how we can analyze PE file to understand whether it has certain suspicious 109
or malicious properties inside it or not. 110
So that's all about this video. 111
Thanks a lot for watching.