Click here to Skip to main content
15,896,915 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Need Source Code for Decoding _Using algorithm Pin
Member 1326117521-Jun-17 18:17
Member 1326117521-Jun-17 18:17 
GeneralRe: Need Source Code for Decoding _Using algorithm Pin
Member 1326117522-Jun-17 2:00
Member 1326117522-Jun-17 2:00 
GeneralRe: Need Source Code for Decoding _Using algorithm Pin
leon de boer22-Jun-17 10:31
leon de boer22-Jun-17 10:31 
QuestionLocal / unique Variable Macro question Pin
ForNow18-Jun-17 8:44
ForNow18-Jun-17 8:44 
AnswerRe: Local / unique Variable Macro question Pin
Iain Clarke, Warrior Programmer18-Jun-17 20:36
Iain Clarke, Warrior Programmer18-Jun-17 20:36 
SuggestionRe: Local / unique Variable Macro question Pin
Jochen Arndt18-Jun-17 21:42
professionalJochen Arndt18-Jun-17 21:42 
AnswerRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 3:40
leon de boer19-Jun-17 3:40 
GeneralRe: Local / unique Variable Macro question Pin
ForNow19-Jun-17 3:55
ForNow19-Jun-17 3:55 
GeneralRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 5:14
leon de boer19-Jun-17 5:14 
GeneralRe: Local / unique Variable Macro question Pin
ForNow19-Jun-17 5:52
ForNow19-Jun-17 5:52 
GeneralRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 9:16
leon de boer19-Jun-17 9:16 
AnswerRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 13:21
Bram van Kampen28-Jun-17 13:21 
GeneralRe: Local / unique Variable Macro question Pin
ForNow28-Jun-17 13:47
ForNow28-Jun-17 13:47 
GeneralRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 14:21
Bram van Kampen28-Jun-17 14:21 
QuestionDisecting a PE File Pin
Bram van Kampen16-Jun-17 14:19
Bram van Kampen16-Jun-17 14:19 
AnswerRe: Disecting a PE File Pin
leon de boer17-Jun-17 3:17
leon de boer17-Jun-17 3:17 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 12:46
Bram van Kampen18-Jun-17 12:46 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 3:11
harold aptroot18-Jun-17 3:11 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 13:05
Bram van Kampen18-Jun-17 13:05 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 13:39
harold aptroot18-Jun-17 13:39 
GeneralRe: Disecting a PE File Pin
Bram van Kampen19-Jun-17 13:27
Bram van Kampen19-Jun-17 13:27 
GeneralRe: Disecting a PE File Pin
harold aptroot19-Jun-17 14:27
harold aptroot19-Jun-17 14:27 
Here's some documentation from microsoft: http://go.microsoft.com/fwlink/p/?linkid=84140
But it doesn't really go into the corner cases. It's more focused on documenting how they think the PE format should be used than on documenting just what sort of insanity is actually accepted by the loader (which of course varies per version of windows). As far as I know MS doesn't even document that, I've only seen it in places such as corkami's github and places that talk about analysis of malware. For example, sections can actually overlap each other in virtual space (wat), with sections that are later in the section table apparently just overwriting the mapping created for an earlier section that extends further than where the later section begins - MS does not even seem to acknowledge that such a thing is possible.
Here's an other description of the PE format by corkami, including a lot of useful practical notes (or gory details..) and references to the POCs in the list I linked before: docs/PE.md at master · corkami/docs · GitHub
GeneralRe: Disecting a PE File Pin
Richard MacCutchan19-Jun-17 20:57
mveRichard MacCutchan19-Jun-17 20:57 
GeneralRe: Disecting a PE File Pin
Bram van Kampen29-Jun-17 12:00
Bram van Kampen29-Jun-17 12:00 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan29-Jun-17 21:28
mveRichard MacCutchan29-Jun-17 21:28 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.