PMA 122: PE Headers (10 pts + 40 extra)

What you need

Purpose

To examine how EXE files work, and how the UPX packer modifies them.

Use the "Windows 10 with Analysis Tools" VM

You can use any Windows system, but it's easiest to use the "Windows 10 with Analysis Tools" machine from an earlier project.

Making a Hello Program

Click Start. Scroll down to the V section, click "Visual Studio 2017", and click "x86 Native Tools Command Prompt for VS 2017".

In the "x86 Native Tools Command Prompt for VS 2017" window, execute these commands, as shown below:

mkdir c:\pe
cd c:\pe
notepad hello.cpp

Notepad asks if you want to create a new file. Click Yes.

Enter this source code, as shown below:

#include <iostream>  
using namespace std;  

void main()
{
        printf("Hello!\n");
}

Save the file.

In the "x86 Native Tools Command Prompt for VS 2017" window, execute these commands, as shown below:

cl /EHsc hello.cpp
hello.exe

MS-DOS Header

Click Start and type PEview. Launch PEview.

Open the C:\pe\hello.exe file in PEview.

In the left pane, click IMAGE_DOS_HEADER.

This header is now unused. The only important features are the first and last item, as shown below.

MS-DOS Stub Program

This program merely prints a message on obsolete MS-DOS systems and is unimportant to us.

IMAGE_NT_HEADERS

This header is important. Note these features, as shown below.

IMAGE_OPTIONAL_HEADER

Note these features, as shown below.

Scrolling down, we see the Import Address Table, at RVA 11000. As we'll see below, that matches the start of the .rdata section.

Section Headers

For each section, note these features, as shown below.

Calculating Memory Layout

Examine each secton in turn and find the RVA and "Virtual Size" values of each one.

Then you can calculate the actual memory layout of the program, by adding the RVA to the Image Base, as shown below.

(The Image Base is in the IMAGE_OPTIONAL_HEADER.)

SectionRVA Memory Address
Image Base 400000
.text1000 401000
.rdata12000 412000
.data19000 419000
.reloc1B000 41B000

Memory Map

To verify the addresses, open hello.exe in x32dbg or OllyDbg and click View, Memory Map.

As shown below, the layout matches the pattern, although the base address was not 400000 on my system.

IMPORT Address Table

In the .rdata section, the first item is the IMPORT Address Table, starting at address 10E00, as shown below.

PMA 122.1: Missing Section (10 pts)

Download this file:

hello2.exe

Examine that file. It has four sections, unlike the one we examined above.

What is the name of the missing section? That's the flag.

PMA 122.2: Broken (20 pts)

Download this file:

peflagh.exe

The file is damaged and cannot run.

Fix it and run it to see the flag.

PMA 122.3: Broken (20 pts)

Download this file:

peflag2h.exe

The file is damaged and cannot run.

Fix it and run it to see the flag.

Hint: If SmartScreen blocks the file, unblock it in the file Properties.

Sources

PE Format from Microsoft
PE File Format Offsets - by Sunshine
Understanding the Import Address Table
Understanding Import Tables #2 - Manually add imports - by Sunshine

Posted 9-23-2020
SmartScreen hint added 9-29-20
brackets around iostream HTML-encoded 9-30-20
Updated 5-30-2021
Extra points enumerated 8-31-2021
FLARE-VM reference removed 9-7-2021