A small presentation dedicated to understanding Win32 Binary basics and how their structure works. We will go through Win32 exe file structures, how do they work. Afterwards we will go through how packing/unpacking works along with some real-time unpacking demos through few popular tools like OllyDbg Debugger, Immunity Debugger, ImpREC, 010 Hex Editor, Python, Python pefile module and so on.

1. Win32BinaryDissection
Sujit Ghosal

2. Agenda
▪ Analysis Classifications
▪ Binary Formats (Unix, Windows and Mac)
▪ Why PE/COFF format?
▪ Some statistical data
▪ PE Format Walkthrough
▪ Tools of the trade
▪ Few demos… 
▪ Q & A
2Win32 Binary Dissection

3. AnalysisClassifications
▪ Static
 Evaluation of an application behavior without the application execution.
i.e. Disassemblers (IDA Pro, Hiew) or any Binary Structure Parser tools etc.
 Time consuming and can be partially automated.
▪ Dynamic
 Understanding of the binary behavior by executing the binary in a “non-controlled”
environment by affecting the host machine and mapping the behaviors i.e. Open
File handles, API calls inspection, Registry entries, Windows start-up entries etc.
 Takes few minutes. Can be (fully/partially) automated.
Win32 Binary Dissection 3

4. BinaryFormats
•PE/COFF [Portable Executable/Common Object File
Format]
•Ref: http://goo.gl/avLg2
Windows
•ELF [Executable and Linkable Format]
•Ref: http://goo.gl/Nd1yvG
Unix/Linux
•Mach-O File Format. Recognizes ELF formats too.
•Ref: http://goo.gl/RXKgE0
Macintosh
4Win32 Binary Dissection

5. WhyPE/COFF format is so importantto know?
▪ Native File Format (mostly undocumented) for Windows PE based files
e.g. .exe // .dll // .ocx // .cpl // .sys // .drv // .scr
▪ Malware binary behavior in-depth understanding
▪ Understanding anti-debugging implementations
▪ Malware heuristics implementations
▪ Quintessential requirement for manual/automated binary unpacking
▪ Automation through idapython, pefile , immlib , mona , pydbg libraries
▪ Binary patching for fun and profit
▪ Addition of your own custom sections into the executable
▪ IAT (Import Address Table) reconstructions
▪ And many more !!! …
Win32 Binary Dissection 5

6. ShadowServerBinariesStats . ..
https://www.shadowserver.org/wiki/pmwiki.php/Stats/PackerStatistics
Win32 Binary Dissection 6

7. PEFormat Walkthrough– And the boring stuff begins… 
sample.exe
(windows loader kicks
in here)
Header
MZ Stub [64]
DOS Stub
[64]
PE Header [24]
Optional Header [96]
Data Directories [16]
Sections
Sections Table
[40]
CODE or .text
Imports [IAT] / Exports [EAT]
Data [Strings, Icons, Bitmaps etc.] 7Win32 Binary Dissection

8. Toolsof thetrade
• IDA Pro [GUI] • ImmLib [Python]
• OllyDbg//Immunity Debugger [GUI] • PEFile [Python]
• AnalyzePE [Python] • PE View / PE-Bear [GUI]
• WinDbg [GUI] • 010 Hex Editor [GUI]
• IDAPython [Python] • CFF Explorer [GUI]
Static Tools
• RegShot [GUI] • Cuckoo Framework [GUI/Web]
• FakeNet [Cmd] • Sandboxie [GUI]
• Process Explorer [GUI] • ZeroWine Sandbox [GUI]
• RegMon [GUI] • INetSim [Cmd]
• Process Hacker [GUI] • TCPView [GUI]
• IDA Pro/Olly/WinDbg [GUI] • ProcMon [GUI]
Dynamic Tools
8Win32 Binary Dissection

9. EXEStructure Walkthrough
9
Win32 Binary Dissection

10. Letsunderstandbinariesthroughdemos!! 
10Win32 Binary Dissection
▪ 010 Hex Editor [For structure parsing]
▪ UPX Compression Tool [For packing]
▪ Immunity//OllyDbg Demo [For unpacking]
▪ ImpREC [Fix IATs]

11. Few real-timescenarios. ..
11Win32 Binary Dissection
▪ Level of binary compression are extremely complex these days. i.e.
Themida, ASPack packages etc.
▪ Time of binary unpacking sometimes takes a week or even more!
▪ Anti-Debugging additions to the binary makes the analysis even painful
▪ Anti-VM modules are the next level of nightmares!
▪ Packed binaries can be embedded inside PDFs, MS-OLE Formats, Flash
Documents, PNG, JPEG images etc! (Caution: Be very sure before
opening any attachments!!)

12. References
12Win32 Binary Dissection
▪ Binary compression: http://goo.gl/ZanFYf
▪ Iczelion’s PE Overview: http://goo.gl/apruSo
▪ UPX: http://goo.gl/KJNWyW

13. 13Win32 Binary Dissection

14. 14