PDA

View Full Version : PE32 ...Configuration Directory??

Maximus
February 5th, 2011, 18:00
well,

the title says all - this is the very first time I met this entry in a PE header. I didNT find any thing around the net, anybody knows what the HELL this PE data directory is??

(OT: anyone has some info on the so called 'security directory' as well?)

The config entry is empty apart an initial byte mark and what seems to be a sort of DWORD at end of an empty buffer, whereas the 'security section' is filled with data - it seemed made of 2 random blocks intermixed with two patterned/regular blocks...

any hint is highly appreciated
Kayaker
February 5th, 2011, 18:57
Is it these two?

IMAGE_LOAD_CONFIG_DIRECTORY

Detailed info in MS PECOFF specs

Quote:
Points to an IMAGE_LOAD_CONFIG_DIRECTORY structure. The information in an IMAGE_LOAD_CONFIG_DIRECTORY is specific to Windows NT, Windows 2000, and Windows XP (for example, the GlobalFlag value). To put this structure in your executable, you need to define a global structure with the name __load_config_used, and of type IMAGE_LOAD_CONFIG_DIRECTORY.



IMAGE_DIRECTORY_ENTRY_SECURITY

Quote:
Points to a list of WIN_CERTIFICATE structures, defined in WinTrust.H. Not mapped into memory as part of the image. Therefore, the VirtualAddress field is a file offset, rather than an RVA.


http://www.delphibasics.info/home/delphibasicsarticles/anin-depthlookintothewin32portableexecutablefileformat-part1
jstorme
February 6th, 2011, 03:36
You can find them both in the MS specs.
http://www.microsoft.com/whdc/system/platform/firmware/pecoff.mspx
Maximus
February 6th, 2011, 12:51
thank you all, guys - i failed at search, unfortunately (it happens, but shame on me, since i brag i can find almost anything on the net :P )

...oh my god:
Quote:
MAGE_DIRECTORY_ENTRY_SECURITY

Points to a list of WIN_CERTIFICATE structures, defined in WinTrust.H

...and I werent even DRUNK when i asked about - no excuses

thanks!!
Woodmann
February 6th, 2011, 18:36
Quote:
i failed at search, unfortunately (it happens, but shame on me, since i brag i can find almost anything on the net :P )


Oh the horror .

I still have +F challenges that I have not completed.

Woodmann