Analysis and modification of PE file formats

Sun Zhenhua Chen Xiaobing

PE means Portable Executable (Portable execution body ). It is the execution file format of the Win32 environment. Some of its features inherit from the Unix Coff (common object file format) file format. "Portable Executable" means that the file format is cross-Win32 platform, even if Windows runs on a non-Intel CPU, the PE Loader on any win32 platform can recognize and use this file format.

In the file system, PE files are binary data, just like other files stored on disks. For the operating system, PE files can be considered as a carrier of specific information, if you want a computer system to execute a program, the program file carrier must conform to a specific format. To analyze the formats of specific information carriers, analysts must be able to analyze data and code. In the win32system, pefiles can be regarded as files of the .exe,. dll,. sys, And. scr types. These files are stored on disks in a regular format.

1. PE format Basics

The following table lists the overall PE structure.

DOS MZ header DOS stub PE header Section table Section 1 Section 2 … Section n

The first five items of a complete PE file must exist. If the file is missing or data fails, the system will refuse to execute the file, as shown in figure

498) this. style. width = 498; "border = 0>

Figure 1 incorrect File Header Format

498) this. style. width = 498; "border = 0>

Figure 2 format data error

498) this. style. width = 498; "border = 0>

Figure 3 code error

The dos mz header is a legacy product of the DOS era. It is a genetic gene of PE files. If a Win32 program can be executed under DOS, it only prompts: "This program cannot be run in DOS mode. then the execution is completed, prompting the executor that the program should be executed in the Win32 system.

The DOS stub part is the DOS plug-in code, which is the 16-bit program code under DOS, just to display the above prompt data. This code is automatically added by the compiler during program compilation.

The PE header is the real Win32 program format header, which includes various information in the PE format and guides the system to load and execute the program code.
Section table is the structure data of PE code and data, indicating where the system code segment is loaded and where the data segment is. For different PE files, the designer may require the file to include different data sections. Therefore, a Section Table is used as an index. The number of sections varies according to the actual situation. But there must be at least one Section. If a program does not even have code, it cannot be called executable code. After Section Table, the number of sections is not fixed.

2. Program loading

When we double-click a file in explorer.exe (resource manager) and execute an executable program, the system starts a program Loader based on the file extension, which is called Loader. Loader will first check the dos mz Header. If yes, it will continue to look for the PE header. If neither of the two items exists, it will be considered as DOS 16-bit code. If only dos mz Header exists, while it indicates the position of the PE Header, the Loader determines that the file is not a valid PE file and refuses to execute.

If both the DOS Header and PE Header are valid, the Loader maps the corresponding code and data to the memory according to the PE Header and Section Table instructions, then initialize the data according to different sections, and finally start to execute the program segment code.

Iii. Advanced Analysis of PE format

Next we will take a real program as an example to analyze the PE format in detail. It is best to analyze the PE format with the PE analyzer. the commonly used software is Lord PE, there are also other analysis tools and software such as PE Editor and Stud PE.

First, analyze the disk file content. Here we use the UltraEdit32 (UE) tool, which is a practical file editor that can edit text and binary files.

498) this. style. width = 498; "border = 0>

Figure 4 disk data starting with a PE File

At the beginning of the file, there are two hexadecimal data 4D 5A, whose ASCII character is MZ, which is the identifier of dos mz Header. The following are dos mz headers listed through Load PE:

1. DOS Header

Data Structure name	Value
E_magic: