LAB-11Medium

PE Header Forensics

Inspect a PE header to find structural anomalies that indicate tampering or packing.

20 min5 prerequisites6 tools

Investigate

Hints

Hint 1

The section table starts after the optional header; count the entries.

Hint 2

Entry point 0x3000 lands in the section with VirtualAddress 0x3000.

Hint 3

Writable + executable = the classic RWX red flag.

Hint 4

RWX defeats Data Execution Prevention.

Submit Findings

Prerequisites

  • w1-pe-deep-dive
  • f1-binary-anatomy
  • PE structure (DOS/NT headers, section table)
  • Section characteristics (RWX)
  • Mitigations: DEP, ASLR, CFG

Methodology

Investigation Methodology

1. Parse DOS Header

  • Offset 0x0: Verify MZ signature
  • Offset 0x3C: Read e_lfanew (little-endian) to NT Headers offset

2. Parse NT Headers

  • Verify PE signature (P E 0 0)
  • COFF File Header: Read NumberOfSections
  • Optional Header: Read AddressOfEntryPoint (RVA)
  • Optional Header: Read DllCharacteristics for mitigations

3. Parse Section Table

For each section (IMAGE_SECTION_HEADER, 40 bytes):

  • Name (8 bytes)
  • VirtualAddress (RVA)
  • VirtualSize
  • SizeOfRawData
  • PointerToRawData
  • Characteristics (permissions)

4. Map Entry Point to Section

For each section, check if EntryPointRVA >= VirtualAddress AND EntryPointRVA < VirtualAddress + VirtualSize. If so, the entry point lies in that section.

5. Analyze Section Permissions

Decode Characteristics flags:

  • 0x20000000 = EXECUTE
  • 0x40000000 = READ
  • 0x80000000 = WRITE

Normal: .text=R-X, .rdata=R, .data=RW. Suspicious: Any RWX (0xE0000000), .text writable, .data executable.

6. Check Mitigations

  • DllCharacteristics & 0x40 = DYNAMIC_BASE (ASLR)
  • DllCharacteristics & 0x100 = NX_COMPAT (DEP)
  • DllCharacteristics & 0x4000 = GUARD_CF (CFG)
  • DataDirectory[10] (LoadConfig) present? SafeSEH, CET, etc.

7. Correlate Findings

  • Entry point in .data + RWX = Packed/Injected
  • Missing relocations + ASLR enabled = Broken ASLR
  • No imports + high entropy = Packed
  • TLS callbacks = Pre-entry code

Common Pitfalls

  • Confusing RVA (relative virtual address) with file offset
  • Missing that `VirtualSize` may be larger than `SizeOfRawData` (for .bss)
  • Not checking all sections for RWX — check every one
  • Forgetting that entry point is RVA, not VA (add ImageBase for VA)
  • Misreading Characteristics flags (endianness, bit positions)

Tools

  • CFF Explorer / PE-bear (GUI)
  • dumpbin /headers (CLI)
  • pefile (Python)
  • Ghidra (Memory Map, Sections)
  • Binary Ninja (Sections view)
  • Built-in Hex Viewer

References

  • Lesson W1: PE Format Deep Dive
  • Lesson F1: Binary Anatomy
  • Microsoft PE/COFF Specification
  • DEP/NX Technology Overview
  • ASLR Implementation

Extensions & Challenges

  • Scan a directory of samples for RWX sections + entry point mismatch
  • Write a YARA rule detecting `DllCharacteristics & 0x100` (DEP) but RWX section
  • Research: How does Windows handle RWX sections with DEP enabled?
  • Analyze a UPX-packed sample: find OEP, dump unpacked, compare headers