Now that we have a deeply explored the Elf format, now let's turn our attention to another value as
binary format, the portable executable format.
Understanding the P format is particularly valuable for analyzing Windows binaries, which are prevalent
in malware analysis and Windows specific applications.
And p portable executable can be seen as modified version of the common object file format F, which
was previously utilized in Unix based systems before being replaced by Elf.
And due to this historical connection, P portable executable is sometimes referred to as P slash C
or F, and it's worth noting that the 64 bit variant of P is called P 32 plus, although there are minor
differences between P 32 plus and the original P format.
For simplicity, we will refer to it as P throughout our section here.
And in this overview of the P format, we will highlight its key distinctions from Elf, providing insights
for those interested in working with Windows binaries.
And it's important to keep in mind that the p e shares many similarities with other formats and fortunately
with our newfound knowledge of Elf, which you learned in previous lecture, exploring additional binary
formats becomes a much smoother journey.
And to facilitate our discussion and aid in visualization, I've created a diagram specifically for
this lecture, and this diagram focuses on the key data structures defined within a win and t dot header
file and essential header file included in the Microsoft Windows Software Development Developer kit.
And now let's delve into the specifics of the P format here.
As you examine the diagram, you will notice that both similarities and crucial differences compared
to the format.
And one significant distinction is the presence of the Ms-dos header within the P format.
So yes, we are referring to Ms-dos, the Microsoft operating system that made its début in 1981.
You might be wondering why such an archaic element exists in a modern binary format.
So the answer lies in backward compatibility, and during the introduction of the P portable executable
format, there are there was a transitional period when users were utilizing both traditional Ms-dos
binaries and a newer P binaries, and to ease this transition and reduce confusion, every P file starts
with an Ms-dos header, enabling it to be interpreted as an Ms-dos binary to some extent and the primary
purpose of the Ms-dos header is to outline how to load and execute an Ms-dos stub, which follows the
Ms-dos header here.
And this step typically consists of a small Ms-dos program that runs instead of the main program when
a user executes a P binary in Ms-dos mode.
And while the Ms-dos stub program often prints a message like, this program cannot be run in Dos mode
and then exists.
It's important to note that in theory it could be fully functional.
Ms-dos version of the program itself and the Ms-dos header begins with a magic value represented by
the Ascii characters M Z.
Hence it is sometimes referred to as an MSI header.
For our purposes, the most important field within the Ms-dos header is the last field known as the
l, f, a, n e w, and this field denotes the file offset at which the actual p p portable executable
binary begins.
And consequently when a portable executable where program loader opens the binary, it reads the Ms-dos
header.
And skips past it along with the Mr. Stop and proceeds directly to the start of the PE heaters.
Now let's explore the PE heaters, which can be seen as the equivalent of Elf's executable loader.
However, in the case of PE, the executable heater here.
Executable file.
Heater PE signature and PE optional heater.
So in the case of the P the portable executable, the executable header is divided here.
Into three distinct parts, a 32 bit signature, a P file header and a P optional.
Header.
And if you refer to the definitions in winrt dot header file, we encounter.
A structure named image and headers 64, which encompasses all three components and collectively we
can consider the entire image and the headers 64 structure as portable executables equivalent of the
executable header.
And however, in practice the signature file header and optional header are treated as separate entities
and each serving a unique purpose in the overall structure of the PE format and.
By gaining a comprehensive understanding of the PE format, we acquired the necessary insights to effectively
analyse the Windows binaries.
Navigating the interface of intricacies of these binaries becomes more feasible as we grasp the inner
workings of the PE format and.
Now what we're going to do is here we will firstly.
Go back to Windows Machine because we will create some program here.
And after that here, let's actually open the.
Our windows machine here.
Where?
And that's it.
Hello.
And now let's write a simple Hello world application using C and compile it in our windows machine.
And let me see here.
Yes.
Here we will create a new file.
This is my.
And here we will.
Hello, world dot C.
Let's save it.
On desktop and here.
So what we're going to do is.
And include here include stdio dot h here.
Let's actually increase the font size a little bit.
You don't want to install any recommended plusplus extension pack because we will not develop any other
than just a simple Hello world application here and integer main here.
And here.
We will again.
As we did on the Linux.
We created our own Hello World application, compiled it, analyze it on in previous lecture for.
P e here and L files.
If you remember that.
And here we will print F print f.
Grand theft here.
We'll just.
Hello?
Well world.
And that's it.
After that, we will return here and that's it.
Now we will open our cmd here.
Let's also increase the font size a little bit to.
Let's give it a color.
And here we will go to the desktop here in desktop.
In this graph.
As you can see, we have Hello world dot C and now we will compile it with GCC.
And as you can see, we have error here because we forgot to.
Oops, we forgot to.
Add the comma here after return.
Sorry.
Here.
And that's it.
Now we will use the Hello world dot C and as you can see, our program is compiled.
This is our dot exit here.
Now we will.
And here, as you can see, we created our Hello World program and we will further analyze this program
on Linux using the objdump.
And however, this file can also be analyzed in Windows system.
But since the Objdump tool comes pre-installed in Linux, we will use it right now.
So we will.
Copy this and we will go back to our Linux machine here.
Holly here.
Enter the password.
We'll copy it right on the desktop.
And so the apex, if we run if we open this, we have some of the data.
Data which you will learn all of this here.
We have also BC.
And now what we're going to do is we will open the terminal.
We'll write the Objdump.
The x here and a x here.
And as you can see, we don't have any file because we are not in the right directory.
We will see the printer directory to desktop and objdump.
With x parameter.
And after that, hello dot x.
And here, as you can see, we have a lot of information going on here.
And the signature is simply a string containing the Ascii characters key, followed by the two new characters
here.
And it is analogous to the magic bytes in the ident field in the Elf executable header.
Um, if you remember, we tested that in the previous section and the file header here describes the
general properties of the file and the most important fields are here.
Actually.
Down a little bit.
That's actually a copy this because.
We will need to analyze it further.
Well, copy all of it here.
Now.
And now we will simply open the mouse path here.
And let's save this as a.
Analyze that.
See, because we want.
The color colors here.
That's it.
And after that, let's turn our terminal font size back to normal.
And here, as you can see here, the most important fields here are machine.
Number of.
Here and.
And here.
Also have the.
Characteristics.
Which is, as you can see, we also have this hex number, relocation stripped, executable line number
strings and 32 bit words here.
And the two fields describing the symbol table are deprecated and the P files should no longer make
use of embedded symbols and debugging information.
And instead these symbols are optionally emitted as part of the separate debug file and as an elf's
machine, the machine field here.
Yeah.
Machine field here.
What but the be that we will go to.
It is.
USR include elf dot a header here.
We'll go to a machine.
And as you can see here, here, this is as you can see, its architecture.
And this in machine here in our life.
This machine field describes the architecture of the machine for which the P file is intended, and
in this case, the.
Excited here.
X 86 and.
64 and which you will you will find this x 60, x 86 and 64 because these here defined as constants
0X0 86 or 0 x.
86 here.
Which you will see at the beginning of the file.
And as you can see, its architecture is different.
That's why.
We didn't return it and file format Pi 386 here in this case.
But if your architecture is 8664 bit, you will see this 86 and 6484 and the last four hex numbers.
And here we also.
Have the number of section fields, that number of sections.
Number of section.
And this number of section field is simply the number of entries in the section header table and the
size of opt optional header is the size in bytes of the optional header that follows the file header
and the characteristics field here.
Characteristics.
Feel.
You can see here zero x 107.
Uh, this field lacks the mark here.
And describing things such as the Indians of the binary.
We have this relocation stripped, executable line number stripped 32 bit words and whether it's a DLL
and whether it has been stripped as shown in our objdump output.
The example binary contains characteristics flags that mark it as a large address.
Now the relocation and executable um executable file here.
And it's a 32 bit words, right?
And it's a line numbers also also the line numbers is stripped which you will you will learn what it
is in next lecture.
And despite what the name suggests, the PE optional header is not really optional for executable.
So it may be missing in object files and in fact you will likely find the portable executable optional
header in any portable executable you will encounter.
Right.
So it contains contains lots of fields and I will go over the most important ones in next lecture.
I'm waiting you in.
Next lecture.