filmov
tv
Understanding the PE+ File Format - Part 4: Entry Points and TLS Callbacks
Показать описание
In Part 4, we focus on the PE+ file format's entry points, specifically the AddressOfEntryPoint and TLS callbacks. The video covers how to find the AddressOfEntryPoint, its role, and entry points' precedence. It also explains locating the IMAGE_TLS_DIRECTORY, enumerating TLS callbacks, and the tools used, including Hiew and an IDAPython script, due to IDA's limitations in viewing these details directly. The session wraps up with a demonstration on dumping TLS entry points for all loaded modules, providing insights into analyzing these crucial elements without unnecessary complexity.
Table of Contents:
00:04 - Introduction
00:24 - PE entrypoints are detected by IDA but only for the input file
01:15 - Inspecting entry points of running processes
01:44 - Starting from the image base / IMAGE_DOS_HEADER
02:16 - Importing the needed standard types (from the Windows SDK headers / TIL)
02:51 - Applying the needed structures
03:11 - Locating the "AddressOfEntryPoint"
03:42 - Understanding entry points precedence
04:36 - Locating the TLS data directory
06:49 - Interpreting the IMAGE_TLS_DIRECTORY
07:56 - IMAGE_TLS_DIRECTORY.AddressOfCallbacks are already relocated
08:33 - Enumerating the TLS callbacks entry points
09:16 - TLS callback prototype is the same as DllMain prototype
09:43 - No built-in in way in IDA to see entry points and TLS callbacks
10:06 - Using Hiew to inspect the TLS callbacks
10:55 - IDAPython script to discover entry points
14:02 - Dumping all TLS entry points for all loaded modules
14:22 - Testing the script
15:11 - NTDLL has no entry point
16:07 - Recap
Resources:
Table of Contents:
00:04 - Introduction
00:24 - PE entrypoints are detected by IDA but only for the input file
01:15 - Inspecting entry points of running processes
01:44 - Starting from the image base / IMAGE_DOS_HEADER
02:16 - Importing the needed standard types (from the Windows SDK headers / TIL)
02:51 - Applying the needed structures
03:11 - Locating the "AddressOfEntryPoint"
03:42 - Understanding entry points precedence
04:36 - Locating the TLS data directory
06:49 - Interpreting the IMAGE_TLS_DIRECTORY
07:56 - IMAGE_TLS_DIRECTORY.AddressOfCallbacks are already relocated
08:33 - Enumerating the TLS callbacks entry points
09:16 - TLS callback prototype is the same as DllMain prototype
09:43 - No built-in in way in IDA to see entry points and TLS callbacks
10:06 - Using Hiew to inspect the TLS callbacks
10:55 - IDAPython script to discover entry points
14:02 - Dumping all TLS entry points for all loaded modules
14:22 - Testing the script
15:11 - NTDLL has no entry point
16:07 - Recap
Resources:
0:11:28
Windows PE File Format: A Peek Behind the Curtain
0:04:20
x64dbg: Understanding PE file format
0:06:29
Malware Theory - Basic Structure of PE Files
0:03:14
12 - Understanding the PE Header - Delving into The Structure of PE File (Infosec Skills)
0:22:30
04 - Intro to PE File Format
0:07:33
Malware Analysis Bootcamp - Understanding The PE Header
0:10:03
Understanding Windows PE file format | Windows Internals
0:40:45
Understanding the PE+ file format - Part 1: The Headers
0:23:48
A Deep Dive into PE File Exports - Understanding Key Structures and How to Navigate
0:08:50
SOC Experts - Anand Guru - Malware Analysis - 09 PE file structure
1:03:04
MM#08 - PE File Format Basics for Malware Analysis and Reverse Engineering
0:10:52
The Basics of Overlays in PE Files
0:12:30
How to Find Digital Certificates in the PE File Format
0:25:02
Lost in the Loader: The Many Faces of the Windows PE File Format
0:35:02
2-Intro to PE File Format
0:10:03
Inside PE Files A Deep Dive into Windows Executables
0:12:19
41-Reviewing 010 Template for PE File Format & How RVA to FOA is Calculated
0:19:02
In-depth: ELF - The Extensible & Linkable Format
0:06:39
PE file structure
0:18:58
Backdooring PE file
0:01:10
PE loading and process creation | PE File Series - Reminthink Notes
0:10:23
What are PE File Forwarded Exports?
0:02:13
18 5 1 PE File Format
0:32:21
Lost in the Loader: The Many Faces of the Windows PE File Format
Комментарии