Let us start by understanding why should one learn about PE file format?
The primary reason is PE is one of the most common file format for executable on Windows platform.
And because the number of people using Microsoft operating system is huge.
Usually we see more malwares written for Windows platform.
Here is a graph that shows almost 50 percent of the malware written are in PE file format, followed by
document types like word, PDF, PPT, etc..
Considering all these factors, it is worth investing our time in learning about the PE file structure,
PE stands for Portable Executable.
All the dot exe and dot dll are PE files, the PE file contains the information required for the operating
system to run the executable.
During malware analysis, this information gives us hints about the functionality of the malware and how
it interacts with operating system.
If you are interested in knowing what is the most common format for the linux distribution, it is ELF
Executable Link File.
With this background, let's start exploring the PE file format.
At this point, I will give you a warning that this model might sound difficult to grasp, but don't
get discouraged.
Just watch this model couple of times to get a fair knowledge on PE file format.
A typical PE file has the following parts.
However, it is not required for a malware analyst to know all the parts of PE file.
So we will simplify the PE structure like this and understand what each part does.
The first part of PE file is called DOS Header.
It is also referred to as MZ header.
It defines that the file is an executable binary.
The DOS header holds, something called as file signature or magic number for Windows executables.
The magic number is 5A 4D in hexadecimal and MZ in ASCII.
The DOS header also contains a value called e Underscore lfa new, which tells the operating system where
to find the PE header location, which as you see is present down here.
Next, we have a DOS stub this mostly exist for backward compatibility.
DOS stands for Disk Operating System, a predecessor of Microsoft Windows in the recent times, as
there are no applications built for does this part of the PE file is just used to print the message the
program cannot be run in DOS mode
After the DOS stub, we have the PE header this is used to define the executable as a PE format.
Signature to represent the PE file is PE00 in ASCII and fifty forty five 00 in hexadecimal
PE header also holds the machine type.
The application is designed to run on like 32 bit or a 64 bit Intel or AMD chipsets.
This part contains information about the number of sections present in the file.
What is the section we will discuss this at the end here.
Additionally, we can get the date and time stamp of when the file was compiled.
The PE header part also holds the size of the optional header.
Next is optional header.
This consists of information like size of code code here refers to the specific section called as
dot text
Address of an entry point.
It is the address in the memory where the PE loader will begin executing.
This is very important during malware analysis as it tells exactly where the code begins.
Preferred Base Address, it is the address of the first byte of image when loaded into the memory,
it must be a multiple of 64 k.
The default for recent versions of Windows is zero x zero zero four.
It also contains the size of the image, which is the size of the image, including all the headers
as the images is loaded in memory.
And operating system version refers to minor and major operating system versions, more about address
and relative address and size of each part in the PE file will be discussed later.
Moving on next, we have the Section table this holds the information like virtual size, which is the total
size of the section when loaded into memory size of the raw data.
This is the size of the initialised, the data on disk and characteristics, the flags that describe
the characteristics of a section like if it is readable, writable, executable, etc..
Finally, we have the section part in the PE file format.
This part contains multiple sections, depending on what the application is trying to achieve, like
dot text section contains the executable code for application dot bss holds uninitialized data
for the application and so on.
All put together here is a snapshot of all the parts of PE header and their brief description.
We have noticed that a couple of terminologies appear again and again through this section like size of
the specific section, address, relative address, etc. What do they mean and how to understand them?
Let's consider a real life analogy to understand these terms better.
Considered a class of students are asked to submit an academic thesis on a topic each student should
pick his or her topic of interest and should research and write a two hundred page thesis in order
to help students on how their thesis has to be structured.
The faculty comes up with a format with the sections like title of the thesis, author adviser, abstract
of the thesis and so on.
Obviously, every thesis will include a table of contents which will help the faculty in quickly navigating
through a 200 page thesis.
Here is where it gets interesting, instead of mentioning the actual page number in the TOC the student
will mention a number of pages consumed by each section, like this title of the thesis is covered in
a total of one page, and it is on page number one.
Author and advisor is a total of page one page.
And it is present on page two, abstract is three pages, and it starts from page number three, problem
statement is two pages and it starts from page number six and so on.
Now, are we making the table of contents simpler by doing something like this?
No, in fact, it is more complicated now, but this example helps us to understand the size and addressing
involved in executing a program.
Here, the size of pages is similar to the size of a section in an executable.
When loaded onto that memory, the number of pages that is the size of each section in the thesis
gives us the information of where the section ends and where the next section starts, which is the
relative virtual address.
The page numbers are the absolute addresses.
Let's get back to the technical learning and see how this correlates in file execution, the file when
executed is loaded into memory that is RAM, but in some random location.
This is how a ram with the unused space would look like.
When executable is loaded onto the memory, it will take some random location in the ram.
The operating system needs to understand where to find the instructions to run the size of a specific
section, tells the computer where to find the next part of the file.
It is worth noting that all memory locations are mentioned in hexadecimal formats like this.