Windows file format detail view note: [MS sysinternals] Process Explorer Process Monitor AutoRuns [http://wjradburn.com/software/] PEview [https://www.wireshark.org/download.html] Wireshark [http://www.ollydbg.de/] OllyDbg

1. Windows File Format
DetailView
John Gang
(Dong-hyun Gang)
CEO - UNIFO COMPANY CO., Ltd.

2. - File & Memory
- PE (Structure)
- Import & Export

3. File & Memory

4. Raw, RVA, andVA

5. PE (Structure)

6. PE Struct

7. EXE File
PE Struct
Hex Edit

8. PE Struct(Hex Edit)

9. PE Struct(DOS Header)

10. PE Struct(Hex Edit)

12. PE Struct(NT Header)

13. PE Struct(Hex Edit)

14. PE Struct(File Header)

15. PE Struct(File Header)
Intel : 0x014C

16. PE Struct(File Header)

17. PE Struct(Optional Header)

18. PE Struct(Section Header)

19. PE Struct(Hex Edit)

20. PE Struct(All)
Number of Section Headers

21. PE Struct(Section Header)
코드 .text
데이터
.data
.rdata
.bss
임포트(Import) API 정보
.idata
.didata
익스포트(Export) API 정보 .edata
리소스 .rsrc
재배치 정보 .reloc
... ...

22. notepad.exe PE Struct

23. Import & Export

24. Import & Export

25. Import & Export
Use Functions(API)
CreateFile(“ReadMe.txt”)
ReadFile(...)
WriteFile(...)
Close(...)
...
use!!!!

26. Import & Export

27. Import & Export
LoadLibrary(kernel32.dll)
Load

28. Import & Export
LoadLibrary(kernel32.dll)
Export
Function

29. END