Hi everybody welcome to the final part of the show a little deeper into the Windows operating system.
So we're going to be going over P E files and DL ls in this video so was a p file P file or portable
executable is a format that Windows uses for an executable object.
Now an executable object can be in most cases it's a dot e XY and in the next slide we'll talk about
deals in a deal is a p e file as well p p e file format is what this is is a data structure that contains
the necessary information for the windows w loader to use the rapt executable code.
So p file is a wrapped executable application which will make more sense when we go over the structure
of it now.
DL It is a p e file as well as we just talked about so.
DL L stands for a dynamically linked library file.
It is a module of compiled code that can be used and referenced to perform specific tasks.
So normally these DL ls will have functions which we have already actually looked at when we were looking
at the Windows API calls.
What we were actually seeing when we saw kernel 32 that is a DL out so the shell exact w shell execute
W which is one of the API calls we looked at in previous videos is nothing more than a specific task
or a function that the DL provided to the application.
Now if we do a quick high level look of the P structure now this is not a fully as deep as it can go
structure.
This is more of a higher level so you can understand the generic sections of it and what the main flow
of the structure is.
So we're starting off with the dos MSE header followed by the DOS stub then the p header where the actual
P file begins then we're going over the section table that contains the data directories and then the
sections which contains the rest of the file.
So we're gonna go over each step of these right now.
So the DOS M.C. header it is the first 64 bytes of each P file and it contains the code 50 for a D in
hex which equates to the letters MSE in ASCII or normal text.
Now this is done for.
So that dos can identify it as an executable.
Now DOS is a disk operating system which is the underlined OS for Windows.
So back in the day it used to just be dos there wasn't windows.
So this is still the core of how Windows runs.
And for it to identify an executable it's looking for that 50 for 80 in hex which again translates to
empty.
Now the DOS stub this is pre pretty short it contains code to be able to print the.
This program cannot be run endorsement.
So if you have an application that was not meant to run as a DOS application or on the command line
it will it'll stop right there and then kick this out and if it is a DOS application meant for the command
line then obviously this part would not run it will still be there but it won't run now the P E header
so this contains fields that will tell the Windows OS loader with the rest of the files going to look
like because the rest of the file passes point can change based on its size and a few other factors
so the first thing we have is a signature.
So a signature for a p file is p dot e followed by two zeros which in hex is going to be no bytes then
it's something called machine.
So this identifies the type of system that it was developed for us or at least compiled for.
So this could be Intel Hamdi etc. the number of sections.
Now this is going to tell us the size of the section's table which follows this particular header which
is important because then it needs to be able to know where the P header stops because there are a few
other options on the P header that I'm not listing here.
However feel free to look up the P header in more detail or the p file structure again in more detail
if you want a more deep dive on bite by bite bit by bit type analysis of it.
But for now just note that this keeps the track of the number of sections so it can know where the end
of this header is so the next part which is data directories which is if we look back up is our section
table so our data directories contains a few things.
It contains an export table import table resource table and probably 10 or 15 other different types
of tables and resource allocations and other things like that.
So the export table.
So what this happens is deal ls are imported from the import table and loaded.
Then once the Windows OS loader grabs a hold of the addresses so on.
So as we show the shell execute w that is a function.
So the OS sort of grabs the address of that function in memory where the DL ls happened to be and then
adds it to the export table to be patched in.
So it's patched into the main application.
This is done during compile time compiling linking which we have an entire section over how programs
are compiled and linked and how all this stuff happens.
So take this as you will.
It's just know that those those functions that we were looking at get patched into the application so
it can be more of a standalone.
Now import table which shows the deals in libraries that will be imported based on what the application
needs.
So this is when you're writing code and you import another module.
That's again what you're going to see here.
Now the resource table is a table of icons and images could be Cursor cursor images any type of image
or icon is going to end up in this resource table so the next is these sections which is the main part
of the P file which is essentially all of the rest of the actual file that you're trying to use so all
the code and everything so it's splitting the multiple sections dot text dot yes our data data our source
e data and data.
Now we're gonna hit each one of these coming up now so the DOT text section this is where all of the
code lids.
So the code for the application all the compiled code for how the application actually functions.
Now this is also commonly referred to at the DOT code section as well.
So if you see Dot tech stock code it's gonna be generally the same thing.
Now the entry point of the application which is in the P E header again what you will see.
An example this in a little bit but the entry points are where the application starts X code execution
is also here next section is dot B.
Yes.
So this is for on initialized data the application.
So for anybody who's familiar with any sort of programming when you initialize a variable such as in
i in this example we don't provided a value so there's no equal sign with a with a number or if this
is a string it's not it doesn't have a string attached to it depending on the language it might append
a string an empty string by default.
But assuming we're not initializing any data to a variable it ends up in here.
And this would show up in the BSA section.
Now our data contains only the read only data.
So this is normally strings or constants.
Now strings are just standard text standard asking unicode.
However constants can be integers floats can be anything as long as the.
It doesn't change which is why it's read only the DOT data section is the opposite of our data.
So when you have an application that you've done a let's say int i is equal to one or two I's equal
to 20 since it's gotten initialized variable or a value of twenty or whatever it might be.
It ends up in this dot data.
So this is for you programming folks out there.
This is the static the global and the local scope variables all end up in here as long as they are initialized
so the our source this contains the resource data.
So the actual images.
So the resource table contained addresses and names for the images and icons.
This is where the data of the actual image is stored.
So we have e data.
I'd add it contains the export table information that we talked about in the previous slide.
This is not always present depending on how the application was designed and what its functions are
but know that the the E table or the the export table contains the resource the names and the addresses.
This is where it contains the actual data and this is data.
This is the opposite.
So this handles the import table again names and addresses of functions.
And what we're gonna do now is go over and take a look at the an executable PBX executable so we're
using something called P explore.
Now this has a hundred and eighty or one hundred and thirty day trial available for anybody who wants
to use it.
Again if you run out of that and you're still testing blow out the virtual machine rebuild it and then
you can reinstall it without having to deal with any license only for if you're testing purposes anyway
don't use it in the business or for professional use that violates licenses.
So again this is linked the link to download it is above this video.
So we're gonna go ahead and open this up.
Oh this is a 30 day valuation.
Sorry about that bigger.
So we're gonna go ahead and open the calc dot XY so this is just standard one that comes in.
So what we're looking at here is the P E header so we can see the machine where we talked about up here
under P here or I don't know if you can you can see that.
So we see machine a number of sections so we've got a number of sections which again is in hex and then
we've got the machine which is ice 386.
And what's also interesting to keep a note of is the time date stamp.
So when it was compiled and then we have our magic number for P E instead of 0 0 we have 32 here which
is fine.
The next thing we're going to do is pull this back up so we can reference this.
So we want to do the data directories.
Right.
So we want to take a look and see what the data directories hold so we can see here we have our export
table import table so in this particular case there's no export table.
There is an import.
We do have resources which will go over in a second.
A few of these others we're not going to go into.
But feel free to look them up if you if you want some extra learning.
They're always good to have a general idea of how how each table works especially if you plan on doing
malware reversing or anything along those lines this is going to be very good information to know.
The next is we have the sections but before we do that I want to take one quick short and go over the
import.
So I don't know if you guys know but I think this looks familiar from based on a previous video we can
see.
Shell 32 shell exactly.
Execute W.
So this is keeping.
So this is exactly what we were looking at before.
So that's what we're looking at before.
Again like I said is the import table.
So that's that's kind of interesting to know.
And then we have our resources.
So we'll do a quick resource look.
So we have icons so we can see here as the calculator icons that were that were used to.
We'll just leave it with the icons for now but if you had other images they would show up here so next
thing is the sections.
So in this case we have our text which contains all of our code we've got our data I data our source
and relax.
So this is the relocation table.
We're not going to worry about that just now.
However if you want to take a quick look.
So it's all gonna be in hex.
However you can take a quick look at some of the some of the data here.
So if we look at the text document you can see that where this is straight hex but we can see some interesting
characters so calculator package you can see calculate package verification successful calculators started
you can see a few bits of information.
Take a look at data doesn't look like we have too much in there.
Those are the import table so we'll see.
We can see Arrigo shell 32 just and that Shell execute w so we can see how it's been it's being pulled.
This is their resource table which contains our images which you can actually sort of see the B I found
of the ah the outline of the calculator icon there and then the relocation table we'll leave that alone.
So this is a piece of file structure.
Now just just to prove that the DLR was of the same so if we grab a random yellow and we continue we're
going to see a very similar structure.
This is I thirty six P E file we have a.
The difference here is we have an export table now of what some of the functions are that it's able
to do.
So these are some of the functions that the comp l DL l file happens to have.
That's kind of interesting.
And then we have our import table so it does import from LTL and TDM well so it looks like we have some
stuff around events trace flags.
Interesting.
And do we have any resources.
No.
Since it's the DLF there's probably not a need for it to have images but we still have Section headers.
So there's still going to be text there's still gonna be data so we take a quick look here.
Interesting and then we have our dock text which this is all compiled so it's gonna be a little bit
more information than just seeing strings because it's a deal.
It's not meant to just be ran normally.
So this has been the P files and DL ls again feel free to kind of dive a little deeper into it if you
have any questions.
Definitely go to the Facebook group everybody is there to help.
I'm always there I'm always checking up on it.
So go ahead and dive deeper in this mess around with P explorer.
At least until the licence expires and then see what other stuff you can kind of come up with.
Remember always research stuff that you don't understand.
So understanding what this particular one does.
I don't know this off the top of my head so I would go and search it understanding that at least knowing
that you've seen it before and a general idea about something always allows you to be able to research
it later because nobody can remember everything unless you're some of those people that just have instant
memory.
I'm not one of them.
Chances are you aren't either.
But if that's not the case then research research research.