Log in

View Full Version : inner details of PE file.


teimaninja
February 16th, 2010, 06:48
just joined the forum...

i want to know the inner details of PE file (hands on way), for example a file that can be found in every win OS ntdll.dll (in the system32 directory).
how can i find those (specific in ntdll.dll and i guess it would be correct for every PE file) details:

Number of sections and name of each section.
"Magic number" (in hex and in ASCII).
Address of entry point.
Size of code.
Size of initialized data.
Size of the optional header.
Size of relocation table.
Base of code.
Base of data.
Number of exported "symbols" (in decimal).
Name and entry point of export symbol with ordinal 27.

Darkelf
February 16th, 2010, 07:54
Well, although you should be able to find the answers yourself using something like good old Google, here is some reading for you, that answers it all:

http://webster.cs.ucr.edu/Page_TechDocs/pe.txt

It's somewhat the standard-description of the PE fileformat. It's written by Bernd Luevelsmeyer. Google the name if you want additional information.

Regards
darkelf

edit: Since I fear that most people nowadays are to lazy to read :| and looking for a tool instead, you may have a look here:

http://www.woodmann.com/collaborative/tools/LordPE

reverser
February 16th, 2010, 18:24
Go to the source:
http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx