3 ms·
These sorts of PE info dumping tools are only really useful for debugging any code you write that tries to parse and/or write PE files. Most reverse engineering
by malwrar 6y ago
These sorts of PE info dumping tools are only really useful for debugging any code you write that tries to parse and/or write PE files. Most reverse engineering use cases already have purpose made tools created for them and directly interrogating the PE headers isn't typically necessary.
In my experience, messing with PE files is useful in a few areas:
- Compiler Development (PE files tell Windows how to load your code into memory, what resources they need/provide, and how to execute your code, etc)
- Reverse Engineering (Extracting the above info, plus locating executable files in memory and dumping them back to disk if they're e.g. packed)
- Game Cheating/Malware (You can simulate the PE loading process to turn e.g. a DLL into what basically amounts to shellcode, allowing you to skip putting your stuff on disk, to make your payloads harder to locate in memory, and to write custom obfuscation as part of the loading process)
There might be more uses I'm not thinking of, but those are the three I have experience with. It's a handy bit of trivia to know if you like dicking around w/ systems-level stuff in Windows for sure.
Probably doesn't need to be said, but just in case PE is how Windows formats .exe, .dll, .sys, etc executable files.
- RealityVoid 6y ago> Probably doesn't need to be said, but just in case PE is how Windows formats .exe, .dll, .sys, etc executable files. It's basically the counterpart of ELF (Executable and Linkable Format) files, but on Windows.