PE Named

PE headers, optional header, and sections name Windows binaries — triage crackmes on $RE_LAB, not commercial cracks.

PE Named• Audio Walkthrough

00:00/03:05

Visual · re_pe_named

PE literacy. $RE_LAB only. Original Cyberlium.

PE starts with MZ — the NT header chain leads to entry and sections.

Portable Executable (PE) format wraps Windows.exe and.dll: DOS stub, PE signature, COFF header, optional header (ImageBase, AddressOfEntryPoint), section table (.text,.rdata,.data). dumpbin or CFF Explorer expose layout for authorized crackmes on $RE_LAB Windows guest. Cyberlium teaches PE literacy parallel to ELF. You will NOT rebuild commercial PEs for license bypass. Next: Sections/Symbols.

1. PE header chain

MZ at offset 0; e_lfanew points to PE\0\0 signature. Machine field marks x86 vs x64; optional header holds subsystem and entry RVA.

On $RE_LAB Windows VM, note ImageBase + EntryPoint RVA for approved crackme — map to disassembler base.

Command guide

Try these commands — PE header chain

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, file. Reference sites: Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format); ELF vs PE (https://man7.org/linux/man-pages/man5/elf.5.html); Binary Ninja PE (https://docs.binary.ninja/guide/types/platform.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Sections and characteristics

.text executable+readable;.rdata read-only constants;.data read/write globals. Characteristics flags tell loader permissions — same literacy as ELF sections.

Packed crackmes may shrink.text entropy — flag for dynamic analysis later on $RE_LAB, not host detonation.