dumpbin.exe, link /dump, and the Portable Executable Format (PE Format)

Hi everyone! This video covers... • Use tooling, SDK headers, and docs to understand/navigate PE/COFF binaries. • The MSVC tool dumpbin.exe which also accessible via the "alias" link /dump. • Portable Executable Format (PE Format). • Identifying PE exe "bitness" ... is a PE exe 32 or 64-bits? • Dumping the PE header, comparing headers. • Dumping a disassembly. • Dumping imports/exports. • Dumping symbols. • Dumping sections. • Determining section location symbol. • Using your brain to parse the PE header. • Every Windows EXE comes with a DOS program: DOS stub, MZ header. • Finding the actual PE header. Tutorial source code: git clone https://github.com/AshleyT3/tutorial-... Clickable Table of Contents 00:00 Start 00:15 Overview 00:30 Install Visual Studio 2022 01:12 Install VSCode 01:28 Install ""hex"" viewer/editor 01:46 SimpleMessageBox console app 02:11 Build debug x86 and x64 03:32 VS command line for x86 03:52 dumpbin, link /dump overview 05:58 dumpbin /headers 07:00 Identifying 32-bit PE exe 07:18 Portable Executable (PE) Format 08:32 link /dump == dumpbin 09:02 prep to compare dumpbin header output 09:33 Open command line for x64 10:00 Identifying a 64-bit PE exe 10:59 comparing x86 / x64 header output 14:25 dumpbin /disasm 15:14 Ghidra better, why dumpbin? 16:59 dump /disasm to file 17:32 finding main in dumpbin disasm 18:26 dumpbin /exports 19:21 dumpbin /imports 23:37 summary of sections 24:13 dumpbin /exports revisited 25:21 dumpbin /symbols 26:18 finding 'main' in .obj file 26:29 Identifying external/static linkage 27:38 Runtime dependency on 'main' function 29:54 identifying symbol section 30:47 disassemble .obj 32:22 your brain the PE parser 32:50 DOS stub/header 33:26 MZ header 33:43 DOS stub's words to the world. 34:31 16-bit tangent (optional) 36:28 SDK headers as docs 37:15 searching SDK headers 37:28 IMAGE_DOS_HEADER (DOS header struct) 38:00 m_cparhdr, size of DOS header 38:53 a paragraph is 16 bytes 39:25 offset to PE header (e_lfanew) 39:36 Windows, a new OS? 40:49 finding the new OS header 43:02 signature in SDK headers 43:24 IMAGE_NT_SIGNATURE (PE00) 43:58 COFF File Header 44:55 Summing it all up 47:45 Outro Buy Me a Coffee https://buymeacoffee.com/ashleypurrin... Ko-fi https://ko-fi.com/ashleypurringtech Subscribe to the AshleyPurringTech email list: https://ashleypurringtech.com/subscribe Other videos: • Hidden 16-bit DOS app inside your Windows apps - Use Ghidra and 16-bit debug.exe to analyze/run it!    • Hidden 16-bit DOS app inside your Windows ...   • Create/Assemble/Link x64 Windows asm exe, Debugging Tools for Windows (WinDbg), stack shadow store.    • Create/Assemble/Link x64 Windows ASM to EX...   • Intro to Ghidra Tutorial 2023 | Setup to Disassembly Window | Ghidra SRE    • Intro to Ghidra Tutorial 2023 | Setup to D...