Portable Executable File Format for Dummies!
Understanding the PE header is crucial for anyone involved in reverse engineering or game hacking. The PE header provides detailed information about the executable file including how it is to be loaded & executed by the Windows operating system. For a detailed description of the PE header & its components please refer to this article on PE header explained
Free on YouTube thanks to sponsorship from Malcore Malware Sandbox
The Windows OS Loader
When an executable is executed, the windows loader creates a virtual address space for the process and maps the executable module from disk into the process' address space. It attempts to load the image at the preferred base address and maps the sections in memory. The loader goes through the section table and maps each section at the address calculated by adding the RVA of the section to the base address. The page attributes are set according to the section's characteristic requirements. After mapping the sections in memory, the loader performs base relocations if the load address is not equal to the preferred base address in ImageBase.
Other Undocumented Windows Structures
Yes there are many undocumented functions & structures with in the Windows operating system that can be used for various purposes including reverse engineering & game hacking. By understanding these hidden features you will get a better idea of how Windows actually functions. For more information about the undocumented functions please check out the guide on undocumented Windows functions & structures
Winternl.h has many of these items but they have member variables labeled "reserved" which is not helpful. For some things the wintern.h header is fine but as you start to do more advanced stuff you will probably want to avoid using it. Mixing and matching winternl.h and the x64dbg header for instance will cause you a headache. My solution to this problem is I prefixed all the x64dbg structures with RFW so they don't interfere with any Windows definitions, you may want to do the same.
Windows Binaries? Just PE Files in memory
A Windows binary, or executable file (EXE), is a program format that Windows uses to run software. At its core is the Portable Executable (PE) format, which includes a header and sections with code, data, and metadata. This PE structure is crucial for the Windows loader to map the file into memory and execute it. When you start a program, the Windows loader uses the PE header to understand how to load and execute it, including resolving DLL dependencies.
A wild fact: Did you know that the difference between EXE and DLL files is fundamentally a matter of naming conventions?
Another Good PE File Format Tutorial
The PE file format is what the Windows operating system uses for its executable files & DLLs. This format includes a DOS header a PE header & several sections that contain code & data. If you ever wanted to know how the Windows PE loader interprets these files the PE file format tutorial might be just for you
File Format Reverse Engineering
When it comes to reverse engineering file formats having the right tools is essential. There are several very powerful tools that can help you dissect & understand the workings behind various file formats. To explore a list of useful reverse engineering tools check out the file format reverse engineering tools guide.