August 2019
Intermediate to advanced
342 pages
9h 35m
English
In our analysis of the PE file format, we will make use of PEView (available online at http://wjradburn.com/software/PEview.zip), which is a very simple but effective tool for visualizing PE structures. As we said, PE is the standard file format of binary images that get executed on a Windows OS.
In fact, when the Windows OS loader loads executables (not limited to .exe, but also including .dll and .sys) in runtime memory, it executes the loading directives found in the PE sections for the binary image to be loaded.
As such, PE file format artifacts remain one of the main targets for malware developers and virus writers.
Read now
Unlock full access