Warning: This document is contains purely technical information. This can be considered as iron, out of which weapons can be made 
Windows uses the Portable Executable Format to store executable files, also known as an “image” of an executable. Although the PE file contains all the information required to “run” a program, the PE file must first be parsed, processed and loaded into memory. This process involves allocation of memory, relocations, imports, etc. Thus, the PE file is simply an “image” of the executable, the executable being referred to the program in memory.
The Portable Executable Format is a highly portable format, compatible for use with many different 32 machines, on the various versions of windows. The PE format can be used identically for 64 bit machines, with very minor modifications.
This document does not act as a standard for the portable executable format, since such manuals already exist. This document also does not cover all the aspects of a portable executable. This document dives head first into the PE format, by directly observing the PE format of a simple test program. It is in the process of understanding the program itself, that the implementation of the PE will also become clear. It concentrates on the most commonly used parts in a usual portable executable, and later an analysis on changing certain values from those parts.
The aim of the project is:
The program chosen for investigation is the standard “Hello World” Program. Its chosen for its simplicity, as well as:
The program, written in C, is:
#include
int main(void){
printf(”Hello World”);
return 0;
}
The code was compiled using Borland C++ compiler, free version 5.5.40.244. It was linked with the link32 linker also provided in the Borland compiler package.
Thus, we get a 51.00 kb .exe file which will be used to investigate into the structure of portable executables
All the fields in the PE file are byte aligned and thus, a hex viewer is necessary to view the file. The following is the source code for the hex viewer which produces a hexadecimal representation of the entire file:
#include
#include
#include
/*
Name: Hex Viewer
Copyright: croSSArrow
Author: Gaurav Tushar Mogre
Date: 30/09/08 18:06
Description: A Basic Hex File Viewer.
*/
using namespace std;
int main(int argc,char* argv[])
{
if(argc<2){
cerr<<”Format: hexviewer.exe
return 1;
}
char fname[41];
strncpy(fname,argv[1],36);
fstream inpfile;
inpfile.open(fname,ios::in|ios::binary);
fstream outfile;
outfile.open(strcat(fname,”.hex”),ios::out|ios::binary);
while(!inpfile.eof()){
unsigned char ch;
inpfile>>ch;
if(ch<16) outfile<<”0×0″<
else outfile<<”0x”<
}
inpfile.close();
outfile.close();
cout<<”Written successfully to file: “<
return 0;
}
Thus, a file: testprogram.exe.hex is produced on running the above program, which generates the hexadecimal representation of testprogram.exe which makes it easier to analyze the file.
We must have usually faced a problem that we cannot ‘view the hidden files’, even after selecting the option from the Folder Options Menu, and when we go back to check, we see that it has been mysteriously restored to ‘Do Not Show Hidden Files & Folders’.
It happens due to a small bug/virus which edits the Registry to create trouble for us.
Here is how we can solve it :
Go to Registry Edit
[Start -> Run -> type "regedit"]
Browse to :
“HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder
\Hidden\SHOWALL”
and set the value of the key “Checked Value” as 1
Open notepad,
copy paste the following [between start and stop]:
// START
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\ Explorer\Advanced\
Folder\Hidden]
“Text”=”@shell32.dll,-30499″
“Type”=”group”
“Bitmap”=hex(2):25,00,53,00,79,00,73,00, 74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00, 65,00,6d,00,33,00,32,00,5c,00,53,00,\
48,00,45,00,4c,00,4c,00,33,00,32,00,2e, 00,64,00,6c,00,6c,00,2c,00,34,00,00,\
00
“HelpID”=”shell.hlp#51131″
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\NOHIDDEN]
“RegPath”=”Software\\Microsoft\\Windows\\ CurrentVersion\\Explorer\\Advanced”
“Text”=”@shell32.dll,-30501″
“Type”=”radio”
“CheckedValue”=dword:00000002
“ValueName”=”Hidden”
“DefaultValue”=dword:00000002
“HKeyRoot”=dword:80000001
“HelpID”=”shell.hlp#51104″
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL]
“RegPath”=”Software\\Microsoft\\Windows\\ CurrentVersion\\Explorer\\Advanced”
“Text”=”@shell32.dll,-30500″
“Type”=”radio”
“CheckedValue”=dword:00000001
“ValueName”=”Hidden”
“DefaultValue”=dword:00000002
“HKeyRoot”=dword:80000001
“HelpID”=”shell.hlp#51105″
// STOP
Save it as whatever_u_want.reg
Double Click on that file to solve the problem,
it can be carried, mailed or kept as back-up too.
(Please remove the space in between registry entries)
Standard BIOS backdoor passwords
The first, less invasive, attempt to bypass a BIOS password is to try on of these standard
manufacturer’s backdoor passwords:
AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256,
j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER,
SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA,
ZAAADA, ZJAAADC, djonet,
AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
Other passwords you may try (for AMI/AWARD or other BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj,phonix,toshiba
remember that passwords are Case Sensitive.
hacking BIOS via software
If you have access to the computer when it’s turned on, you could try one of those
programs that remove the password from the BIOS, by invalidating its memory.
However, it might happen you don’t have one of those programs when you have access
to the computer, so you’d better learn how to do manually what they do. You can reset
the BIOS to its default values using the MS-DOS tool DEBUG (type DEBUG at the
command prompt. You’d better do it in pure MS-DOS mode, not from a MS-DOS shell
window in Windows). Once you are in the debug environment enter the following
commands:
AMI/AWARD BIOS
O 70 17
O 71 17
Q
