Portable executable analysis
Any UNIX or Windows binary executable file will have a header to describe its structure. This includes the base address of its code, data sections, and a list of functions that can be exported from the executable. When an executable file is executed by the operating system, first of all the operating system reads its header information and then loads the binary data from the binary file to populate the contents of the code and data sections of the address for the corresponding process.
A Portable Executable (PE) file is the file type that a Windows operating system can execute or run. The files that we run on Windows systems are Windows PE files; these can have EXE, DLL (Dynamic Link Library), and SYS (Device Driver) ...
Get Effective Python Penetration Testing now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
