this is the live version of an overview of the Portable Executable format and its malformations presented at Hashdays, in Lucerne, on the 3rd November 2012 direct download link: http://corkami.googlecode.com/files/ange_albertini_hashdays_2012.zip

1. Binary art
Byte-ing the PE that fails you
Ange Albertini 3rd November 2012
http://corkami.com Lucerne, Switzerland

2. agenda
what's a PE?
the problem, and my approach
overview of the PE format
classic tricks
new tricks
© ID software

3. Portable Executable
based on
Common Object File Format

6. PEuniversal
Windows binary
since 1993

7. pe101.corkami.com

8. the problem...

9. aka “the gentle guide to standard PEs”

10. CVE-2012-2273
version_mini
ibkernel

11. normal

15. ...and my approach

17. block by block

18. a complete executable

19. pe.corkami.com

28. PE DLL
...
call [API] API: …
… ret
Imports Exports

35. maxsecXP
65535sects

37. 1 ≤ FileAlignment == SectionAlignment ≤ 800
nosection*

38. tiny*

40. foldedhdr

41. ctxt*

42. ★New★ tricks

43. mini
normal64

44. dllnomain*

45. dd OriginalFirstThunk
dd TimeDateStamp
dd ForwarderChain
----------------------------
dd Name
dd FirstThunk
imports_virtdesc

46. corkamix

47. seh_change64

48. fakerelocs
ibreloc

50. reloccrypt

51. reloccrypt

52. reloccrypt

53. maxvals

54. hdrcode

55. traceless

56. PE .NET
... ...
imports ...
... ...
... ...
... ...
... relocs
... ...
... ...
... ...
... ...
... ...
... ...
... ...
... ...
... CLR
... ...
tinynet

57. quine

58. corkamix

59. Conclusion

60. Conclusion
● the Windows executable format is complex
● mostly covered, but many little traps
● new discoveries every day :(
http://pe101.corkami.com
http://pe.corkami.com

61. Questions?
Thanks to
Fabian Sauter, Peter Ferrie, ‫وليد عصر‬
Bernhard Treutwein, Costin Ionescu, Deroko, Ivanlef0u, Kris Kaspersky, Moritz Kroll, Thomas Siebert,
Tomislav Peričin, Kris McConkey, Lyr1k, Gunther, Sergey Bratus, frank2, Ero Carrera, Jindřich Kubec, Lord
Noteworthy, Mohab Ali, Ashutosh Mehra, Gynvael Coldwind, Nicolas Ruff, Aurélien Lebrun, Daniel
Plohmann, Gorka Ramírez, 최진영 , Adam Błaszczyk, 板橋一正 , Gil Dabah, Juriaan Bremer, Bruce Dang,
Mateusz Jurczyk, Markus Hinderhofer, Sebastian Biallas, Igor Skochinsky, Ильфак Гильфанов, Alex
Ionescu, Alexander Sotirov, Cathal Mullaney

62. Thank YOU!
Ange Albertini @gmail.com
@ange4771
http://corkami.com

63. exe2pe, dosZMXP

64. aa86drop.com