PE Anatomist – Explore data structures in portable executable files | Hacker News Reader

PE Anatomist – Explore data structures in portable executable files

rammerlabs.alidml.ru

72 pointsURfejk15 comments

Open articleView on HN

How is it different from say for example https://mzrst.com/ or http://www.pe-explorer.com/.

Is it being open-source the USP?

"PE" in this context stands for "Portable Executable". (For those not in the know, such as myself.)

Thank you - I was wondering what a "Private Equity" file might look like...

I would say an excel spreadsheet :)

The way a PE file is defined is interesting. They managed to cram a completely different file format into the DOS 'MZ' format. Including the NE and LE formats. I think the NE one had a bunch of sub targets (OS/2, win32s, etc).

https://wiki.osdev.org/PE https://wiki.osdev.org/NE

It is quite the nesting doll of executable formats. If I remember correctly PE also holds .NET in some way as another sub format.

There's a clue in the title.

It's possible that I missed that, but I believe the HN poster silently updated the title. The word "executable" does not appear anywhere in the HTML of the target page.

(sigh at how acronyms are the source for endless insider snark.)

"There are currently no plans to publish the source code either. Those who are hungry can use any disassembly tool, there is nothing supernatural in the program code."[1]

this seems kind of strange. does MIT lic. permit that the source code be withheld?

https://rammerlabs.alidml.ru/faq-eng.html

This attitude doesn't encourage me to use the product. It's so unnecessarily hostile that I expect they are going to have some kind of drama in the future and cause headaches for the users.

I'm guessing if the product is popular they want to have the ability to monetize it in the future.

Great! I find such tools useful for analysis and they come in handy sometimes.

Sad that this tool also is not open source but better then nothing. So Thanks to the author!

What are some cool things that are possible? - extract resources I guess. Is this Russian program trust worthy.

There are similar open source programs doing the same or more.

Ghidra probably the most powerful. The PE structures are public, every compiler, binutil or decompiler has it.

These sorts of PE info dumping tools are only really useful for debugging any code you write that tries to parse and/or write PE files. Most reverse engineering use cases already have purpose made tools created for them and directly interrogating the PE headers isn't typically necessary.

In my experience, messing with PE files is useful in a few areas:

  - Compiler Development (PE files tell Windows how to load your code into memory, what resources they need/provide, and how to execute your code, etc)
  - Reverse Engineering (Extracting the above info, plus locating executable files in memory and dumping them back to disk if they're e.g. packed)
  - Game Cheating/Malware (You can simulate the PE loading process to turn e.g. a DLL into what basically amounts to shellcode, allowing you to skip putting your stuff on disk, to make your payloads harder to locate in memory, and to write custom obfuscation as part of the loading process)

There might be more uses I'm not thinking of, but those are the three I have experience with. It's a handy bit of trivia to know if you like dicking around w/ systems-level stuff in Windows for sure.

Probably doesn't need to be said, but just in case PE is how Windows formats .exe, .dll, .sys, etc executable files.

> Probably doesn't need to be said, but just in case PE is how Windows formats .exe, .dll, .sys, etc executable files.

It's basically the counterpart of ELF (Executable and Linkable Format) files, but on Windows.

> What are some cool things that are possible? - extract resources I guess. Is this Russian program trust worthy.

Yes, it's guaranteed to have been backdoored by the NSA.

I suppose it's probably possible for this thing to download and run some malware, but the VirusTotal results are clean[0].

[0]: https://www.virustotal.com/gui/url/826fca3edb8d883bb9710cabb...

Reply on news.ycombinator.com