Click here to Skip to main content
15,905,912 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Disecting a PE File Pin
harold aptroot19-Jun-17 14:27
harold aptroot19-Jun-17 14:27 
Here's some documentation from microsoft: http://go.microsoft.com/fwlink/p/?linkid=84140
But it doesn't really go into the corner cases. It's more focused on documenting how they think the PE format should be used than on documenting just what sort of insanity is actually accepted by the loader (which of course varies per version of windows). As far as I know MS doesn't even document that, I've only seen it in places such as corkami's github and places that talk about analysis of malware. For example, sections can actually overlap each other in virtual space (wat), with sections that are later in the section table apparently just overwriting the mapping created for an earlier section that extends further than where the later section begins - MS does not even seem to acknowledge that such a thing is possible.
Here's an other description of the PE format by corkami, including a lot of useful practical notes (or gory details..) and references to the POCs in the list I linked before: docs/PE.md at master · corkami/docs · GitHub
GeneralRe: Disecting a PE File Pin
Richard MacCutchan19-Jun-17 20:57
mveRichard MacCutchan19-Jun-17 20:57 
GeneralRe: Disecting a PE File Pin
Bram van Kampen29-Jun-17 12:00
Bram van Kampen29-Jun-17 12:00 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan29-Jun-17 21:28
mveRichard MacCutchan29-Jun-17 21:28 
GeneralRe: Disecting a PE File Pin
Bram van Kampen30-Jun-17 14:19
Bram van Kampen30-Jun-17 14:19 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan30-Jun-17 21:30
mveRichard MacCutchan30-Jun-17 21:30 
GeneralRe: Disecting a PE File Pin
Bram van Kampen2-Jul-17 13:26
Bram van Kampen2-Jul-17 13:26 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan2-Jul-17 21:42
mveRichard MacCutchan2-Jul-17 21:42 
QuestionStreamin proc for Rich edit Pin
ForNow16-Jun-17 9:27
ForNow16-Jun-17 9:27 
QuestionRe: Streamin proc for Rich edit Pin
David Crow16-Jun-17 17:40
David Crow16-Jun-17 17:40 
AnswerRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 15:43
ForNow17-Jun-17 15:43 
GeneralRe: Streamin proc for Rich edit Pin
David Crow17-Jun-17 16:09
David Crow17-Jun-17 16:09 
GeneralRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 16:28
ForNow17-Jun-17 16:28 
Questionikspropertset declaring variable ksps Pin
Member 1326135415-Jun-17 5:58
Member 1326135415-Jun-17 5:58 
AnswerRe: ikspropertset declaring variable ksps Pin
Richard MacCutchan15-Jun-17 6:13
mveRichard MacCutchan15-Jun-17 6:13 
GeneralRe: ikspropertset declaring variable ksps Pin
Member 1326135415-Jun-17 8:35
Member 1326135415-Jun-17 8:35 
GeneralRe: ikspropertset declaring variable ksps Pin
Richard MacCutchan15-Jun-17 8:49
mveRichard MacCutchan15-Jun-17 8:49 
GeneralRe: ikspropertset declaring variable ksps Pin
jeron116-Jun-17 5:31
jeron116-Jun-17 5:31 
QuestionHow to make LDPC parity check matrix H from non-systematic to systematic in C/C++ Pin
Member 1326117515-Jun-17 1:42
Member 1326117515-Jun-17 1:42 
QuestionDynamically create memory based on 2 different struture templates Pin
manoharbalu14-Jun-17 1:19
manoharbalu14-Jun-17 1:19 
AnswerRe: Dynamically create memory based on 2 different struture templates Pin
Richard MacCutchan14-Jun-17 4:32
mveRichard MacCutchan14-Jun-17 4:32 
GeneralRe: Dynamically create memory based on 2 different struture templates Pin
manoharbalu14-Jun-17 20:27
manoharbalu14-Jun-17 20:27 
GeneralRe: Dynamically create memory based on 2 different struture templates Pin
Richard MacCutchan14-Jun-17 22:40
mveRichard MacCutchan14-Jun-17 22:40 
GeneralRe: Dynamically create memory based on 2 different struture templates Pin
manoharbalu14-Jun-17 22:44
manoharbalu14-Jun-17 22:44 
GeneralRe: Dynamically create memory based on 2 different struture templates Pin
Richard MacCutchan14-Jun-17 23:18
mveRichard MacCutchan14-Jun-17 23:18 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.