Reverse › Module 4 › Lesson 2
PE Named
PE headers, optional header, and sections name Windows binaries — triage crackmes on $RE_LAB, not commercial cracks.
Visual · re_pe_named
PE literacy. $RE_LAB only. Original Cyberlium.
Opening
PE starts with MZ — the NT header chain leads to entry and sections.
Portable Executable (PE) format wraps Windows.exe and.dll: DOS stub, PE signature, COFF header, optional header (ImageBase, AddressOfEntryPoint), section table (.text,.rdata,.data). dumpbin or CFF Explorer expose layout for authorized crackmes on $RE_LAB Windows guest. Cyberlium teaches PE literacy parallel to ELF. You will NOT rebuild commercial PEs for license bypass. Next: Sections/Symbols.
1. PE header chain
MZ at offset 0; e_lfanew points to PE\0\0 signature. Machine field marks x86 vs x64; optional header holds subsystem and entry RVA.
On $RE_LAB Windows VM, note ImageBase + EntryPoint RVA for approved crackme — map to disassembler base.
Command guide
Try these commands — PE header chain
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, file. Reference sites: Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format); ELF vs PE (https://man7.org/linux/man-pages/man5/elf.5.html); Binary Ninja PE (https://docs.binary.ninja/guide/types/platform.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sections and characteristics
.text executable+readable;.rdata read-only constants;.data read/write globals. Characteristics flags tell loader permissions — same literacy as ELF sections.
Packed crackmes may shrink.text entropy — flag for dynamic analysis later on $RE_LAB, not host detonation.
3. PE literacy boundaries
Forbidden: patching commercial PE exports for piracy, resigning stolen drivers, or analyzing neighbor's licensed installers without authorization.
Ship: PE triage lines — Machine, EntryPoint RVA, ImageBase for one $RE_LAB crackme. Next: Sections/Symbols.
4. What you ship: PE triage sheet for $RE_LAB
PE header highlights for one approved crackme. $RE_LAB named. NEVER commercial crack rebuilds. chmod 600.
5. What you record before the next lesson
Date. PE triage. $RE_LAB named. File t23-m04-l02-pe-named.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Rebuild cracked game PE. Analyze paid installer from torrent.
Right
Write PE triage for $RE_LAB crackme. Next: Sections/Symbols.
Mission: triage one PE crackme
1) Log Machine and EntryPoint RVA. 2) List.text and.rdata purposes. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
RVA + ImageBase = runtime address (before ASLR rebasing).
Knowledge Check
APPLY: PE literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: PE files begin with MZ signature at offset 0.
True or False
Knowledge Check
APPLY: AddressOfEntryPoint in optional header is:
Multiple choice