Hello and welcome back.
In this video lecture, I'm going to talk about portable executable file, also known as P P files are
Windows executable files.
You can know whether or not files be found by opening.
So let's analyze our sample.
And it has detected ninety eight point seven percent that it is an easy fire, so easy files are portable,
executable files, portable executable files have a structure which looks like this.
We have the Amzi Darth header and stop pinheaded session table and the various sections that if we use
another tool now to study to be far structure, open up a flash folder and open the utilities folder
and look for a program called CFF Explorer.
That is symbol for one into the CFA explorer to open it, as you can see here, the pea farm has several
hadiths and some hideous.
And some of these collapsible three views, the first header is known as the Darth Vader, if you click
on their Darth Vader, you will see the various parts of the dust header on the right.
The first column, he's the member.
He's placed the name of the field and the first few is called in, which is the bite's.
Fire A for the in reverse is clearly a hex editor.
You can see here for the fire is the magic number and magic by AMZI.
Whenever you see it means that this is a Beevor for sure.
Arepas has this magic by AMZI if you want.
If you go down further you will see the text.
This is this program cannot be run industrial and Shandley below that he was be.
So these are positive confirmation.
Amzi and the string.
This program cannot be run in the smoke and the magic base.
So these treaties confirm that this is a BFA Windows executable FA.
So the header here shows you the first by first device for the fire.
Why is this in reverse?
Because on internal systems, the P C start the little engine.
The other engine is a convention for storing bias in reverse order.
The second column here is the offset from the start stack of that header and then the site tells you
the size of the header.
What means two bytes, as you can see, two bytes to base to base, and then the value column contains
the value of the base in those offsets.
Next, let's talk about init base.
When Windows load her processing to memory, it copies includes a up for any sections from the hard
disk into the process.
Which element.
But first he needs to allocate space in virtual memory.
But how does he know and what a location should be allocating the space.
What a memory to copy to be found.
Any sections.
This information comes from the image base feel in the B file under optional header.
So, yes, you can see the base and he is a value for that.
Now let's open the file and let's start our process.
Hechler.
Now, you scroll down, you see sample for one here, that is double click and examine the memory,
the visual memory for this process.
This process is nine memory.
And we see from the CFF Explorer that the emission base is zero zero four, followed by five zeros.
And let's go to that location.
And there you go.
This is your initial base.
So this confirms what you see here in this case,
however, this is not always true Windows who look the value of this image based here as a recommendation,
sometimes he doesn't allow the use of the recommendation here.
This can happen when the memory in the process, which you address, is already occupied by other contents.
So you cannot always rely on this recommendation here and confirm that it is here.
Sometimes it might be in other locations, other things of interest, the address or entry point.
This one is the value shown in this column, a relative who actual addresses also known as offsets.
So in short, we call them ARV's for relative virtual addresses.
So when you see address of entry point, this offset one zero four zero.
If you want to find the actual location in visual memory, you would take the base address, which is
this value plus this offset that would give you zero zero four zero one zero four zero.
And that at your entry point, that is.
Now try to check this.
We've extended to GBG.
So just click on Extra to GBG, who now close this program and will use history to GBG to execute this
program to the budget Astarita DVD.
He said you were just getting direct from here.
And it's run to the entry point.
True enough, it stops in two point zero zero four zero one zero four zero.
So this is confirmation of what we just need the entry point of sarnies one zero four zero.
So to find the actual which address, you take this or set it to the base address in which base, which
is this.
And that gives you this entry point four zero one zero four zero.
That is go back now to analyze the data.
Yeah.
Three minutes before the dossier to indigenous entities and session here.
This session is now here.
Take a look at it outside the starts.
Head Start.
He magic feel we have already discussed.
If you scored on this, feel right to the bottom.
Evictees we have in this visi.
This location is the shochu, the offset to the start of the beheader.
The behavior is ended in this one.
And you can't be in a hex editor.
So energy and then if you go down to this offset is zero.
You will learn in the end data.
You can see Aizu.
Easier and easier offset, you get your five zero four five, which is a.
So this is a dossier and this is your behavior, also known as A..
So the header is left over from the days of DOS Windows.
This is to enable progress to be backward compatible.
So if you try to run today's Windows application in dozen more, you will also run.
But if we show this message, this program cannot be run.
That is why Microsoft may retain this.
Amzi does it.
So when you run any Windows entity, you would just come here, look for the piata and execute from
here.
So the behavior is also known as A..
The interior is further split into Fada and optional HAINA entities.
Does this feel for 050, which is B in reverse?
Five zero four five.
Five zero four five in reverse.
Let's take a look at the fight in Nevada.
Six one, two, three, four, five, six, seven.
Let's take a look at the machine.
The machine few tells you what is the processor for this?
Beevor, the target processor.
And here we can see it is Intel three six.
If you double click this, we can change the type of processor and you can see the kind, a long list
here.
But if you to the other processor, this thing will not be able to run anymore because it's a wrong
processor target.
We just need to see this next year, a number of sections.
So this will hold a number of sections present in a BFA.
And here you can see the two sections, one and two.
So sections one, two sections, sections to various kinds of data and information in an executive are
court and some on data tax could could means instructions can execute and data means strings or constants
or variables or structures.
Sometimes malware, viruses, foreign factors and peckers modify programs by adding extra sections in
here that contains malicious code and data.
So when they do this, they also need to manipulate these few.
To increase it, to change the value here, currently issuing to next year characteristic.
You can double click on this to see more information.
You can see that the farthest executable, it is not a jail and that it'll be proven next.
Here is the optional header.
Although it is called optional header, it is not optional.
It is very important.
Windows will make use of this option.
I hate it when it is copying the file into what your memory in order to run as a process.
The two most important features in the option as we have seen the entry point and as an entry point
and the image piece.
This would be your data on Directress to day three's contains the size and the argues reality, virtual
addresses, offsets that contains important data tables and directories.
Some of them are blank zero zero zero zero, as you can see.
Which means there's nothing but some Haskell values, for example, here in a tree.
And this offset continues.
There is in the data section and another one here in Portland, RESTABILIZE directory.
Next, we look at the session data.
And here's where the first column is.
A name, the name few contains as can text and data.
Normally text means they can execute and data on use, which contains data only Mithaka.
But this is not reliable memory.
I can give you any name he wants.
Sometimes you can also get executable in the data section, so we cannot rely on these labels.
The words your address is the column.
Here is the RV in which the section is placed in virtual memory.
To get the actual which should address, we need to add this to the base, as you've seen earlier,
our size is the size of the section data of the file on the disk.
If you click right, click and select the change, fly right, click and and select session play, you
can see more information.
For example, I just click on the first row and select playing and I see that this section contains
flex indicating it is executable, is readable and it contains good.
If I click on the second one second, second row and click on to second place, I can see that this
session is readable.
Writable contains initialized data, but doesn't contain any code.