PE STRUCTURE PE STRUCTURE PE File Format DOS

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER

이승현(Secudent) | Bo. B 4 | Pwn&Play | PE STRUCTURE

Slides: 23

Download presentation

PE STRUCTURE

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT 2. NT_HEADER 프로그램이 윈도우 시스템에서 동작하기 위한 정보를 가 지고 있음. 이 부분은 3가지로 구성되어있는데, 다음과 같다. - Signature 50 45 00 00 ( PE ) - IMAGE_FILE_HEADER - IMAGE_OPTIONAL_HEADER [ test 123. exe ]

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT 3. SECTION HEADER PE 파일은 CODE, DATA, RESOURCE 등의 영역을 각각의 Section 단위로 나누어 저장한다. 왜? DATA와 CODE가 같이 있으면, DATA에 값이 쓰일 때 , CODE에 overwrite되기 때문에 동작하지 않을 것 = 안전성 유지 목적 각각의 Section의 속성을 기술할 Header. typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD Physical. Address; DWORD Virtual. Size; } Misc; DWORD Virtual. Address; DWORD Size. Of. Raw. Data; DWORD Pointer. To. Relocations; DWORD Pointer. To. Linenumbers; WORD Number. Of. Relocations; WORD Number. Of. Linenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; [ test 123. exe ] . text 실행 코드를 가진다. CPU에 의존적. 실행만 가능, 쓰기 불가능 . data 초기화된 전역 변수를 가진다. 컴파일러가 여기에 변수를 마련 . rdata 읽기 전용의 변수. 문자열 상수나 const선언 변수들을 저장 . edata Export할 함수에 대한 정보를 가짐. DLL경우에만 이 섹션존재 . idata Import할 함수에 대한 정보를 가짐. 어떤DLL에 있는함수가필요한지 저장

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT DOS HEADER typedef struct _IMAGE_DOS_HEADER { WORD e_magic; . . . LONG e_lfanew } IMAGE_DOS_HEADER , *PIMAGE_DOS_HEADER ; DOS STUB HEADER NT HEADER typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER File. Header; IMAGE_OPTIONAL_HEADER 32 Optional. Header; } IMAGE_NT_HEADERS 32 , *PIMAGE_NT_HEADERS 32 ; SECTION HEADER typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME ]; union { DWORD Physical. Address; DWORD Virtual. Size; } Misc; DWORD Virtual. Address; DWORD Size. Of. Raw. Data; DWORD Pointer. To. Relocations; DWORD Pointer. To. Linenumbers; WORD Number. Of. Relocations; WORD Number. Of. Linenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER , *PIMAGE_SECTION_HEADER ; FILE HEADER typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD Number. Of. Sections; DWORD Time. Date. Stamp; DWORD Pointer. To. Symbol. Table; DWORD Number. Of. Symbols; WORD Size. Of. Optional. Header; WORD Characteristics; } IMAGE_FILE_HEADER , *PIMAGE_FILE_HEADER ; OPTIONAL HEADER typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; BYTE Major. Linker. Version; BYTE Minor. Linker. Version; DWORD Size. Of. Code; DWORD Size. Of. Initialized. Data; DWORD Size. Of. Uninitialized. Data; DWORD Address. Of. Entry. Point; DWORD Base. Of. Code; DWORD Base. Of. Data; DWORD Image. Base; DWORD Section. Alignment; DWORD File. Alignment; WORD Major. Operating. System. Version; WORD Minor. Operating. System. Version; WORD Major. Image. Version; WORD Minor. Image. Version; WORD Major. Subsystem. Version; WORD Minor. Subsystem. Version; DWORD Win 32 Version. Value; DWORD Size. Of. Image; DWORD Size. Of. Headers; DWORD Check. Sum; WORD Subsystem; WORD Dll. Characteristics; DWORD Size. Of. Stack. Reserve; DWORD Size. Of. Stack. Commit; DWORD Size. Of. Heap. Reserve; DWORD Size. Of. Heap. Commit; DWORD Loader. Flags; DWORD Number. Of. Rva. And. Sizes; IMAGE_DATA_DIRECTORY Data. Directory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES ]; } IMAGE_OPTIONAL_HEADER 32 , *PIMAGE_OPTIONAL_HEADER 32 ;

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT DOS HEADER typedef struct _IMAGE_DOS_HEADER { WORD e_magic; . . . LONG e_lfanew } IMAGE_DOS_HEADER , *PIMAGE_DOS_HEADER ; DOS STUB HEADER NT HEADER typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER File. Header; IMAGE_OPTIONAL_HEADER 32 Optional. Header; } IMAGE_NT_HEADERS 32 , *PIMAGE_NT_HEADERS 32 ; SECTION HEADER typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME ]; union { DWORD Physical. Address; DWORD Virtual. Size; } Misc; DWORD Virtual. Address; DWORD Size. Of. Raw. Data; DWORD Pointer. To. Relocations; DWORD Pointer. To. Linenumbers; WORD Number. Of. Relocations; WORD Number. Of. Linenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER , *PIMAGE_SECTION_HEADER ; FILE HEADER typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD Number. Of. Sections; DWORD Time. Date. Stamp; DWORD Pointer. To. Symbol. Table; DWORD Number. Of. Symbols; WORD Size. Of. Optional. Header; WORD Characteristics; } IMAGE_FILE_HEADER , *PIMAGE_FILE_HEADER ; DATA DIRECTORY typedef struct _IMAGE_DATA_DIRECTORY { DWORD Virtual. Address; DWORD Size; } IMAGE_DATA_DIRECTORY , *PIMAGE_DATA_DIRECTORY ; OPTIONAL HEADER typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; BYTE Major. Linker. Version; BYTE Minor. Linker. Version; DWORD Size. Of. Code; DWORD Size. Of. Initialized. Data; DWORD Size. Of. Uninitialized. Data; DWORD Address. Of. Entry. Point; DWORD Base. Of. Code; DWORD Base. Of. Data; DWORD Image. Base; DWORD Section. Alignment; DWORD File. Alignment; WORD Major. Operating. System. Version; WORD Minor. Operating. System. Version; WORD Major. Image. Version; WORD Minor. Image. Version; WORD Major. Subsystem. Version; WORD Minor. Subsystem. Version; DWORD Win 32 Version. Value; DWORD Size. Of. Image; DWORD Size. Of. Headers; DWORD Check. Sum; WORD Subsystem; WORD Dll. Characteristics; DWORD Size. Of. Stack. Reserve; DWORD Size. Of. Stack. Commit; DWORD Size. Of. Heap. Reserve; DWORD Size. Of. Heap. Commit; DWORD Loader. Flags; DWORD Number. Of. Rva. And. Sizes; IMAGE_DATA_DIRECTORY Data. Directory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES ]; } IMAGE_OPTIONAL_HEADER 32 , *PIMAGE_OPTIONAL_HEADER 32 ;

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT DOS HEADER e_magic : MZ e_lfanew : 다음에 실행될 헤더 오프셋 DOS STUB HEADER FILE HEADER Machine : CPU 별로의 고유한 값 Number. Of. Sections : 섹션의 개수 Size. Of. Optional. Header : 옵셔널헤더 구조 체의 크기 Characteristics : 파일의 속성 값 (DLL? EXE? SYS? ) NT HEADER OPTIONAL HEADER Magic : Optional. Header의 매직넘버 (IMAGE_OPTIONAL_HEADER 64, 020 B) Address. Of. Entry. Point : 최초로 실행되는 코드의 시작 주소 (eip=AOEP+Imagebase) Image. Base : PE 파일이 로딩되는 시작 주소(exe-00400000, dll 10000000) Section. Alignment : 메모리에서 섹션의 최소단위(보통 4 K) File. Alignment : 파일에서의 섹션의 최소단위(보통 512) Size. Of. Image : 메모리에 로딩되었을 때 가상 메모리에서 PE 이미지 크기(헤더+) Size. Of. Headers : PE 헤더의 전체 크기 Subsystem : GUI면 2, CUI면 3, 시스템드라이브 파일이면 1 Number. Of. Rva. And. Sizes : Data. Directory의 배열 개수(통상 0 x 10) DATA DIRECTORY Signature : PE 00 FILE HEADER OPTIONAL HEADER SECTION HEADER Virtual. Size : 메모리에서 섹션이 차지하는 크기 Virtual. Address : 메모리에서 섹션의 시작주소 (RVA) Size. Of. Raw. Data : 파일에서 섹션이 차지하는 크기 Pointer. To. Raw. Data : 파일에서의 섹션시작위치 Characteristics : 섹션의 속성(bit or) #define #define IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE// 실행 IMAGE_SCN_MEM_READ // 읽기 IMAGE_SCN_MEM_WRITE // 쓰기 DATA DIRECTORY #define #define // #define #define IMAGE_DIRECTORY_ENTRY_EXPORT IMAGE_DIRECTORY_ENTRY_IMPORT IMAGE_DIRECTORY_ENTRY_RESOURCE IMAGE_DIRECTORY_ENTRY_EXCEPTION IMAGE_DIRECTORY_ENTRY_SECURITY IMAGE_DIRECTORY_ENTRY_BASERELOC IMAGE_DIRECTORY_ENTRY_DEBUG IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE IMAGE_DIRECTORY_ENTRY_GLOBALPTR IMAGE_DIRECTORY_ENTRY_TLS IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT IMAGE_DIRECTORY_ENTRY_IAT IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0 // Export Directory 1 // Import Directory 2 // Resource Directory 3 // Exception Directory 4 // Security Directory 5 // Base Relocation Table 6 // Debug Directory 7 // (X 86 usage) 7 // Architecture Specific Data 8 // RVA of GP 9 // TLS Directory 10 // Load Configuration Directory 11 // Bound Import Directory in headers 12 // Import Address Table 13 // Delay Load Import Descriptors 1 R 4 // COM Runtime descriptor

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT IAT(Import Address Table) 프로그램이 어떤 라이브러리에서 어떤 함수를 사용하고 있는지 기술한 테이블 typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; DWORD Original. First. Thunk; } DUMMYUNIONNAME; DWORD Time. Date. Stamp; DWORD Forwarder. Chain; DWORD Name; DWORD First. Thunk; } IMAGE_IMPORT_DESCRIPTOR; // 0 for terminating null import descriptor // RVA to original unbound IAT (PIMAGE_THUNK_DATA) Import Name Table // 0 if not bound, // -1 if bound, and real datetime stamp // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O. W. date/time stamp of DLL bound to (Old BIND) Name[라이브러리 명] // -1 if no forwarders // RVA to IAT (if bound this IAT has actual addresses) Import Address Table 근데, 저 구조체의 위치는 어디에 있나? ? PE HEADER ? ? . .

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT IMAGE_OPTIONAL_HEADER. Data. Directory[1]. Virtual. Address에 있다. typedef struct _IMAGE_DATA_DIRECTORY { DWORD Virtual. Address; DWORD Size; } IMAGE_DATA_DIRECTORY , *PIMAGE_DATA_DIRECTORY ;

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; DWORD Original. First. Thunk; } DUMMYUNIONNAME; DWORD Time. Date. Stamp; DWORD Forwarder. Chain; DWORD Name; DWORD First. Thunk; } IMAGE_IMPORT_DESCRIPTOR; // 0 for terminating null import descriptor // RVA to original unbound IAT (PIMAGE_THUNK_DATA) // 0 if not bound, // -1 if bound, and real datetime stamp // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O. W. date/time stamp of DLL bound to (Old BIND) Original. First. Thunk(구조체) == Import Name Table(Peview) Name(구조체) == Name RVA(Peview) First. Thunk(구조체) == Import Address Table(Peview) // -1 if no forwarders // RVA to IAT (if bound this IAT has actual addresses) IAT INT

PE STRUCTURE PE File Format | DOS HEADER | NT HEADER | SECTION HEADER | IMAGE_IMPORT_DESCRIPTOR | EAT(Export Address Table) 라이브러리 파일에서 제공하는 함수를 다른 프로그램에서 가져다 사용할 수 있도록 함 -> 해당 라이브러리에서 Export하는 함수의 주소를 정확히 구할 수 있음. typedef struct _IMAGE_EXPORT_DIRECTORY { 실제 Export 함수 개수 DWORD Characteristics; DWORD Time. Date. Stamp; Export 함수 중에서 이름을 가지는 함수 WORD Major. Version; WORD Minor. Version; Export 함수 주소 배열 DWORD Name; DWORD Base; 함수 이름 주소 배열 DWORD Number. Of. Functions; DWORD Number. Of. Names; DWORD Address. Of. Functions; // RVA from base of image. Ordinal 주소 배열 DWORD Address. Of. Names; // RVA from base of image DWORD Address. Of. Name. Ordinals; // RVA from base of image } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; IMAGE_OPTIONAL_HEADER. Data. Directory[0]. Virtual. Address = EAT

이승현(Secudent) | Bo. B 4 | Pwn&Play | PE STRUCTURE