corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0c503-44c4-7009-94d8-e4dc30a77844

A primer on Windows PE files and doing API calls without knowledge of memory layout

codeinsecurity.wordpress.com · published 18 August 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at codeinsecurity.wordpress.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
10
Words captured
3,990

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://github.com/GJDuck/e9patch/issues/1
github.com
https://twitter.com/gsuberland/
twitter.com
https://chaos.social/@gsuberland
chaos.social
https://bytepointer.com/articles/the_microsoft_rich_header.htm
bytepointer.com
https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header
docs.microsoft.com
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/peb/index.htm
geoffchappell.com
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm
geoffchappell.com
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry.htm
geoffchappell.com