Warning: This document is contains purely technical information. This can be considered as iron, out of which weapons can be made 
Introduction:
Windows uses the Portable Executable Format to store executable files, also known as an “image” of an executable. Although the PE file contains all the information required to “run” a program, the PE file must first be parsed, processed and loaded into memory. This process involves allocation of memory, relocations, imports, etc. Thus, the PE file is simply an “image” of the executable, the executable being referred to the program in memory.
The Portable Executable Format is a highly portable format, compatible for use with many different 32 machines, on the various versions of windows. The PE format can be used identically for 64 bit machines, with very minor modifications.
This document does not act as a standard for the portable executable format, since such manuals already exist. This document also does not cover all the aspects of a portable executable. This document dives head first into the PE format, by directly observing the PE format of a simple test program. It is in the process of understanding the program itself, that the implementation of the PE will also become clear. It concentrates on the most commonly used parts in a usual portable executable, and later an analysis on changing certain values from those parts.
Aims:
The aim of the project is:
- To develop an understanding on the structure of the Portable Executable
- Understanding the process involved in loading of a PE image file from the hard disk to the memory
- To emulate the working of the windows loader
- Ability to create and alter any portable executable file to suit needs and wants.
Preparations:
The Test Program:
The program chosen for investigation is the standard “Hello World” Program. Its chosen for its simplicity, as well as:
- It uses library calls for outputting to a console
- The main standard sections in the executable are used.
The program, written in C, is:
#include
int main(void){
printf(”Hello World”);
return 0;
}
The code was compiled using Borland C++ compiler, free version 5.5.40.244. It was linked with the link32 linker also provided in the Borland compiler package.
Thus, we get a 51.00 kb .exe file which will be used to investigate into the structure of portable executables
Preparing the Hex Viewer:
All the fields in the PE file are byte aligned and thus, a hex viewer is necessary to view the file. The following is the source code for the hex viewer which produces a hexadecimal representation of the entire file:
#include
#include
#include
/*
Name: Hex Viewer
Copyright: croSSArrow
Author: Gaurav Tushar Mogre
Date: 30/09/08 18:06
Description: A Basic Hex File Viewer.
*/
using namespace std;
int main(int argc,char* argv[])
{
if(argc<2){
cerr<<”Format: hexviewer.exe
return 1;
}
char fname[41];
strncpy(fname,argv[1],36);
fstream inpfile;
inpfile.open(fname,ios::in|ios::binary);
fstream outfile;
outfile.open(strcat(fname,”.hex”),ios::out|ios::binary);
while(!inpfile.eof()){
unsigned char ch;
inpfile>>ch;
if(ch<16) outfile<<”0×0″<
else outfile<<”0x”<
}
inpfile.close();
outfile.close();
cout<<”Written successfully to file: “<
return 0;
}
Thus, a file: testprogram.exe.hex is produced on running the above program, which generates the hexadecimal representation of testprogram.exe which makes it easier to analyze the file.
