Click here to Skip to main content
15,901,284 members
Please Sign up or sign in to vote.
4.00/5 (1 vote)
See more:
From the beginning i am hearing that exe consists of 3 main parts,
.rcsc
.text
.data
-some time these too
(.reloc)
(.ndata)
(.rdata)

exe file starts with magic sig "MZ".
exe file has an entry point called (EP).It has export table , import table, check-sums..

hummm strange...

My question is How do i open exe file to get this information,
packer , unpackers, pe scanner's and AV's are use this concept to examine a particular file.

code, documents any thing is welcome.

thanks for reading this gibberish.

_UPDATE_

For example :
Consider file.exe ,
i want to open this file and search for particular byte pattern.

For ex : ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
this is byte pattern for packer called "$pirit v1.5"
?? are wildcard bytes.
Posted
Updated 11-May-11 21:34pm
v3
Comments
Joan M 12-May-11 3:22am    
Do you want us to explain you how to open a file to read its contents and then how to parse them or do you want us to give some kind of structure that can be read in all exe's?

Could you clarify it a little?
Archit9373284448 12-May-11 3:25am    
yes sir :)

In c#:
byte[] data = File.ReadAllBytes(@"F:\Temp\XXX.exe");

You can then parse the data as you will.
MSDN[^]
 
Share this answer
 
Comments
Joan M 12-May-11 3:50am    
5ed... exactly what he needs...
You may find introductory material and above all, useful links to the PE format specifications here: "PE page at Wikipedia"[^].
 
Share this answer
 
v2
Comments
Archit9373284448 12-May-11 3:38am    
that was an introduction about PE , i read that before posting here, but tanks a lot for you effort
:)
CPallini 12-May-11 3:58am    
The links to the format specifications are the valuable material, there. You should study it befeore attempting to parse.
Archit9373284448 13-May-11 8:49am    
yes i did, i have some docs from underground community which i read + this wiki

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900