Reverse › Module 4 › Lesson 2
PE Named
PE headers, optional header, and sections name Windows binaries — triage crackmes on $RE_LAB, not commercial cracks.
Visual · re_pe_named
PE literacy. $RE_LAB only. Original Cyberlium.
Opening
PE starts with MZ — the NT header chain leads to entry and sections.
Portable Executable (PE) format wraps Windows.exe and.dll: DOS stub, PE signature, COFF header, optional header (ImageBase, AddressOfEntryPoint), section table (.text,.rdata,.data). dumpbin or CFF Explorer expose layout for authorized crackmes on $RE_LAB Windows guest. Cyberlium teaches PE literacy parallel to ELF. You will NOT rebuild commercial PEs for license bypass. Next: Sections/Symbols.
1. PE header chain
MZ at offset 0; e_lfanew points to PE\0\0 signature. Machine field marks x86 vs x64; optional header holds subsystem and entry RVA.
On $RE_LAB Windows VM, note ImageBase + EntryPoint RVA for approved crackme — map to disassembler base.
Command guide
Try these commands — PE header chain
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Microsoft PE format — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format (MZ/PE headers literacy) ELF vs PE — https://man7.org/linux/man-pages/man5/elf.5.html (compare on YOUR Linux lab binary) Binary Ninja PE — https://docs.binary.ninja/guide/types/platform.html (PE platform literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest) Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
curl -sS https://learn.microsoft.com/en-us/windows/win32/debug/pe-format | head -10
xxd -l 4 "$LAB_RE/bin/hello"
file "$LAB_RE/bin/hello"
echo 'PE literacy: on Windows analyze YOUR .exe with dumpbin — Linux lab uses ELF'Primary tools to practice this lesson: curl, file. Reference sites: Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format); ELF vs PE (https://man7.org/linux/man-pages/man5/elf.5.html); Binary Ninja PE (https://docs.binary.ninja/guide/types/platform.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sections and characteristics
.text executable+readable;.rdata read-only constants;.data read/write globals. Characteristics flags tell loader permissions — same literacy as ELF sections.
Packed crackmes may shrink.text entropy — flag for dynamic analysis later on $RE_LAB, not host detonation.
3. PE literacy boundaries
Forbidden: patching commercial PE exports for piracy, resigning stolen drivers, or analyzing neighbor's licensed installers without authorization.
Ship: PE triage lines — Machine, EntryPoint RVA, ImageBase for one $RE_LAB crackme. Next: Sections/Symbols.
4. What you ship: PE triage sheet for $RE_LAB
PE header highlights for one approved crackme. $RE_LAB named. NEVER commercial crack rebuilds. chmod 600.
5. What you record before the next lesson
Date. PE triage. $RE_LAB named. File t23-m04-l02-pe-named.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Rebuild cracked game PE. Analyze paid installer from torrent.
Right
Write PE triage for $RE_LAB crackme. Next: Sections/Symbols.
Mission: triage one PE crackme
1) Log Machine and EntryPoint RVA. 2) List.text and.rdata purposes. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
RVA + ImageBase = runtime address (before ASLR rebasing).
Knowledge Check
APPLY: PE literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: PE files begin with MZ signature at offset 0.
True or False
Knowledge Check
APPLY: AddressOfEntryPoint in optional header is:
Multiple choice