Record · corpus.blog/posts/01a0876c-4fbe-70cc-99c5-d8a0cae20686

Static Analysis Research - Windows PE

/home/dganev · published 6 January 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at dganev.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 22
Words captured: 5,019

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/mandiant/flare-floss

github.com

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-intro?view=windows-11

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/memory/data-execution-prevention

learn.microsoft.com

https://en.wikipedia.org/wiki/Address_space_layout_randomization

en.wikipedia.org

http://4d5asecurity.com/why-4d5a

4d5asecurity.com

https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/

virusbulletin.com

The devil’s in the Rich header Read at the source ↗

securelist.com

https://en.wikipedia.org/wiki/COFF

en.wikipedia.org

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header32

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/debug/pe-format

learn.microsoft.com

http://www.nynaeve.net/?p=91

nynaeve.net

https://stackoverflow.com/questions/42413937/why-pe-need-original-first-thunkoft

stackoverflow.com

https://github.com/mmn3mm/peresources

github.com

https://0xrick.github.io/win-internals/pe7/

0xrick.github.io

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header?redirectedfrom=MSDN

learn.microsoft.com

https://chat.openai.com/

chat.openai.com

https://www.mandiant.com/resources/blog/automatically-extracting-obfuscated-strings

mandiant.com

https://stackoverflow.com/questions/36550038/in-utf-16-utf-16be-utf-16le-is-the-endian-of-utf-16-the-computers-endianness

stackoverflow.com

https://0xrick.github.io/

0xrick.github.io

https://forensicitguy.github.io/rich-header-hashes-with-pefile/

forensicitguy.github.io

http://ieeexplore.ieee.org/stamp/stamp.jsp?arn

ieeexplore.ieee.org