Original subtitles

1

Welcome to this lesson, to understand windows executables we must have some notions about their structure

2

portable executable it's a structure used by windows to represent an executable like .exe, .dll, .sys among the best known

3

for our proposes it's important because will give us some clues to catch malware, specially when we are performing static analysis.

4

On this lesson I'm going to teach you the windows portable executable structure.

5

As I said before this structure is in charge of manage windows executables and will give us some clues for our malware analysis

6

Your gonna find this chart with some variations it doesn't matter. I am gonna explain the essential parts,

7

the parts we need for malware analysis. This is in my opinion the most complete portable executable representation we can find,

8

you can see the author here in the corner.

9

What we got here is an executable file, name “simple”, which is only displaying the typical “Hello world” message.

10

the executable is divided in two parts, header and sections, which in turn are divided into more parts.

11

The DOS header section used to be for compatibility when windows and Dos coexist, so it really doesn't matter now.

12

Let see the hexadecimal dump. As you probably know for your computer to understand instructions

13

it has to be done in binary. An hexadecimal dump is a representation of a binary data stream,

14

where the content of that stream are displayed in hexadecimal values.

15

In the ascii dump column we have the ascci representation of these values, lets take this MZ and put it in this translator,

16

as you can see the hexadecimal dump is 4d 5a This 4d5a is the distinctive mark, a seal If you want of Windows files,

17

if you see this 4d5a in the hexadecimal dump you can be 100% sure is a windows file.

18

By the way MZ stands for the developer Mark Zbikowski.

19

Ok, next we have the portable executable header

20

this starts with the signature, this PE stands for portable executable of course,

21

then we have Machine and this hexadecimal is important because indicates the processor this executable is intended to work with.

22

We’ll see this in more detail in the File type lesson

23

Next part as its name states is optional if the executable has this header you can find the processor type here in the magic number

24

Ok, on next section we have the data directories. These are pointers mostly to exports and imports.

25

On Import section you’ll find all api functions this executable need to consume,

26

and in Export section you’ll find all functions this executable is willing to share,

27

hold that thought a I’ll show you this using a tool in a minute.

28

This sections table Defines how the file is loaded in memory ,it contains a list of all sections in the executable,

29

not important for now

30

I remind you we are checking out this executable name “simple”, this file is only displaying the Hello world message,

31

and here we have the code in assembly language you can see the assembly code's executable in a debugger,

32

we are not going into assembly language, but If you wanna see a debugger in action,

33

check lesson Analyzing malicious dlls more ahead on this course.

34

I’d like to point out your not going to find this equivalent C code in the portable structure, you use a decompiler for that.

35

is just something the author add for us to compare the assembly and its language C equivalent code.

36

Now on this imports structures we can see the apis this .exe need for execution,

37

note aside there are always more apis involve but for this example this is ok.

38

For the message Hello world to display we need these apis Exit procces and messageboxA

39

belonging to kernel32.dll and user32dll, you’ll see a lot of this apis when inspecting the file in static analysis

40

Like any other program, Windows needs functions to do everything, these functions are the windows apis that are contained into dlls,

41

let see this using cff explorer tool.

42

I am just giving you a glance we’ll see this in detail later.

43

on this tool we can see the import and export directory of this file,

44

in the import directory you'll see a lot of this dll user32 dll and kernel32 dll

45

they contain very important apis that this file needs to work,

46

in the export directory we find the functions this file is willing to share

47

we'll see more of this along the course.

48

lets go back to our document

49

Finally we have the string that will be display: Hello world

50

we'll use this structure on next lessons, so don't worry if don't get it now.

51

Also you can check all windows apis visiting resources section, I left you a link there.

52

Don't miss next video, we'll use a malware sample on File Type lesson.