Chapter 4. Basic usage

Table of Contents

Getting headers and sections
Looking at function directories
Comparing PE pieces
Analyzing suspicious files

Getting headers and sections

readpe is the right tool for parsing PE files without infer anything regarding its fields and values. Using readpe you can see all basic PE file information. For example, in order to see the Optional Header, you could run:

$ readpe --header optional putty.exe
Optional/Image header
    Magic number:                    0x10b (PE32)
    Linker major version:            7
    Linker minor version:            10
    Size of .text section:           0x5c000
    Size of .data section:           0x27000
    Size of .bss section:            0
    Entrypoint:                      0x54eb0
    Address of .text section:        0x1000
    Address of .data section:        0x5d000
    ImageBase:                       0x400000
    Alignment of sections:           0x1000
    Alignment factor:                0x1000
    Major version of required OS:    4
    Minor version of required OS:    0
    Major version of image:          0
    Minor version of image:          0
    Major version of subsystem:      4
    Minor version of subsystem:      0
    Size of image:                   0x84000
    Size of headers:                 0x1000
    Checksum:                        0
    Subsystem required:              0x2 (IMAGE_SUBSYSTEM_WINDOWS_GUI)
    DLL characteristics:             0
    DLL characteristics names
    Size of stack to reserve:        0x100000
    Size of stack to commit:         0x1000
    Size of heap space to reserve:   0x100000
    Size of heap space to commit:    0x1000


The Magic Number is 0x10b for PE32 files and 0x20b for PE32+ files.

In order to parse pev tools output you can use the -f / --format option. The following example will output the DOS Header in HTML:

$ readpe --format html --header dos putty.exe
<!DOCTYPE html>
<html lang="en" dir="ltr">
    <meta charset="utf-8">
    <title>src/build/readpe --format html --header dos /home/user/PUTTY.EXE</title>
    <div class="object">
        <h2>DOS Header</h2>
        <p><span class="key"><b>Magic number</b></span>: <span class="value">0x5a4d (MZ)</span></p>
        <p><span class="key"><b>Bytes in last page</b></span>: <span class="value">144</span></p>
        <p><span class="key"><b>Pages in file</b></span>: <span class="value">3</span></p>
        <p><span class="key"><b>Relocations</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>Size of header in paragraphs</b></span>: <span class="value">4</span></p>
        <p><span class="key"><b>Minimum extra paragraphs</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>Maximum extra paragraphs</b></span>: <span class="value">65535</span></p>
        <p><span class="key"><b>Initial (relative) SS value</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>Initial SP value</b></span>: <span class="value">0xb8</span></p>
        <p><span class="key"><b>Initial IP value</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>Initial (relative) CS value</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>Address of relocation table</b></span>: <span class="value">0x40</span></p>
        <p><span class="key"><b>Overlay number</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>OEM identifier</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>OEM information</b></span>: <span class="value">0</span></p>
        <p><span class="key"><b>PE header offset</b></span>: <span class="value">0xf8</span></p>

By combining readpe output with a filter like grep you could easily get the PE file entrypoint in CSV format by filtering the readpe output:

$ readpe --format csv --header optional putty.exe | grep ^Entry

With readpe you can inspect the PE sections as well. Use -S option to see information about all PE sections, just like this:

$ readpe -S putty.exe
        Name:                            .text
        Virtual Address:                 0x1000
        Physical Address:                0x5bd41
        Size:                            0x5c000 (376832 bytes)
        Pointer To Data:                 0x1000
        Relocations:                     0
        Characteristics:                 0x60000020
        Characteristic Names
        Name:                            .rdata
        Virtual Address:                 0x5d000
        Physical Address:                0x1ceda
        Size:                            0x1d000 (118784 bytes)
        Pointer To Data:                 0x5d000
        Relocations:                     0
        Characteristics:                 0x40000040
        Characteristic Names
        Name:                            .data
        Virtual Address:                 0x7a000
        Physical Address:                0x5924
        Size:                            0x2000 (8192 bytes)
        Pointer To Data:                 0x7a000
        Relocations:                     0
        Characteristics:                 0xc0000040
        Characteristic Names
        Name:                            .rsrc
        Virtual Address:                 0x80000
        Physical Address:                0x3b90
        Size:                            0x4000 (16384 bytes)
        Pointer To Data:                 0x7c000
        Relocations:                     0
        Characteristics:                 0x40000040
        Characteristic Names