Cyberlium
Cyberlium
Cyberlium on Android·Google Play Store

Learn cybersecurity with hands-on labs and AI mentor support on your phone.

Reverse › Module 4 › Lesson 2

BeginnerModule 4Lesson 2/5

PE Named

PE headers, optional header, and sections name Windows binaries — triage crackmes on $RE_LAB, not commercial cracks.

15 min+40 XP3 quiz
Module progress2 of 5

Visual · re_pe_named

PE literacy. $RE_LAB only. Original Cyberlium.

Opening

PE starts with MZ — the NT header chain leads to entry and sections.

Portable Executable (PE) format wraps Windows.exe and.dll: DOS stub, PE signature, COFF header, optional header (ImageBase, AddressOfEntryPoint), section table (.text,.rdata,.data). dumpbin or CFF Explorer expose layout for authorized crackmes on $RE_LAB Windows guest. Cyberlium teaches PE literacy parallel to ELF. You will NOT rebuild commercial PEs for license bypass. Next: Sections/Symbols.

1. PE header chain

MZ at offset 0; e_lfanew points to PE\0\0 signature. Machine field marks x86 vs x64; optional header holds subsystem and entry RVA.

On $RE_LAB Windows VM, note ImageBase + EntryPoint RVA for approved crackme — map to disassembler base.

Command guide

Try these commands — PE header chain

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, file. Reference sites: Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format); ELF vs PE (https://man7.org/linux/man-pages/man5/elf.5.html); Binary Ninja PE (https://docs.binary.ninja/guide/types/platform.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Sections and characteristics

.text executable+readable;.rdata read-only constants;.data read/write globals. Characteristics flags tell loader permissions — same literacy as ELF sections.

Packed crackmes may shrink.text entropy — flag for dynamic analysis later on $RE_LAB, not host detonation.

3. PE literacy boundaries

Forbidden: patching commercial PE exports for piracy, resigning stolen drivers, or analyzing neighbor's licensed installers without authorization.

Ship: PE triage lines — Machine, EntryPoint RVA, ImageBase for one $RE_LAB crackme. Next: Sections/Symbols.

4. What you ship: PE triage sheet for $RE_LAB

PE header highlights for one approved crackme. $RE_LAB named. NEVER commercial crack rebuilds. chmod 600.

5. What you record before the next lesson

Date. PE triage. $RE_LAB named. File t23-m04-l02-pe-named.txt chmod 600.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Rebuild cracked game PE. Analyze paid installer from torrent.

  • Right

    Write PE triage for $RE_LAB crackme. Next: Sections/Symbols.

Mission: triage one PE crackme

1) Log Machine and EntryPoint RVA. 2) List.text and.rdata purposes. 3) chmod 600.

Stuck? Ask Cyberlium AI Mentor

RVA + ImageBase = runtime address (before ASLR rebasing).

Knowledge Check

1

APPLY: PE literacy on Cyberlium means:

Multiple choice

Knowledge Check

2

APPLY: True or False: PE files begin with MZ signature at offset 0.

True or False

Knowledge Check

3

APPLY: AddressOfEntryPoint in optional header is:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)