Binalyzer: Phase 3 is now complete!

comparando el análisis de secciones entre ELF y PE, explicando las diferencias de formato y cómo las abordaste.

At last, Phase 3 for Binalyzer is now complete! It now lists sections for both PE and ELF files. I'll keep it short and sweet this time since most of the information can be already understood from reading my previous post, so I'll keep the key takeaways of what I did here.

What did you do?

I thought you'd never ask.

Reading format

Obviously, since ELF and PE are both for fundamentally different operating systems, reading and parsing these fields for each section is different from eachother. I looked up on the documentation for PE's section format to be able to figure out how to read it and did the usual with methods like read() and unpack() to do some of the heavy lifting for me.

Make sure that you're reading every single field of the section, otherwise, you might get into trouble since the data will be displaced

Reading names

Reading the names for each section was a similar process. Since they are padded with null bytes (x\00), I had to remove them with the replace() method.

Getting flags

I couldn't have thought of the proper solution without AI for this one (and I'm genuinely ashamed of this one tbh), since each flag value is stored in a hexadecimal digit, and more importantly, some digits might be the sum of two or more flag values; so I had no idea whatsoever to solve this little puzzle myself. Turns out, using bitwise AND (&) does the trick. You just check the comparison of characteristics & flag == flag and store the flag in a flags dictionary as the key (with the description being the value, you will see and example later on)

What is the output for these PEs then?

Here you go.

cmd.exe: Header and first three sections

File path: /mnt/c/Windows/system32/cmd.exe
Filetype: PE
Magic number 0x20b
PE Header :
    COFF Offset : 248
    Signature : b'PE\x00\x00'
    File Header :
        Machine : x64
        NumberOfSections : 8
        TimeDateStamp : 2091-09-06 23:01:06+00:00
        PointerToSymbolTable : 0
        NumberOfSymbols : 0
        SizeOfOptionalHeader (bytes) : 240
        Characteristics :
            0x2 : Executable file
            0x20 : Can handle >2GB addresses
    Optional Header :
        Standard Fields :
            Magic : PE32+
            MajorLinkerVersion : 14
            MinorLinkerVersion : 38
            SizeOfCode : 233472
            SizeOfInitializedData : 217088
            SizeOfUnitizializedData : 0
            AddressOfEntryPoint : 162592
            BaseOfCode (address) : 4096
Sections :
    [0]
    Name : .text
    VirtualSize : 0x37db6
    VirtualAddress : 0x1000
    SizeOfRawData : 0x38000
    PointerToRawData : 0x1000
    PointerToRelocations : 0x0
    PointerToLinenumbers : 0x0
    NumberOfRelocations : 0x0
    NumberOfLinenumbers : 0x0
    Characteristics :
        0x0 : Reserved for future use
        0x20 : Contains executable code
        0x20000000 : Can be executed as code
        0x40000000 : Can be read

    [1]
    Name : fothk
    VirtualSize : 0x1000
    VirtualAddress : 0x39000
    SizeOfRawData : 0x1000
    PointerToRawData : 0x39000
    PointerToRelocations : 0x0
    PointerToLinenumbers : 0x0
    NumberOfRelocations : 0x0
    NumberOfLinenumbers : 0x0
    Characteristics :
        0x0 : Reserved for future use
        0x20 : Contains executable code
        0x20000000 : Can be executed as code
        0x40000000 : Can be read

    [2]
    Name : .rdata
    VirtualSize : 0x9b38
    VirtualAddress : 0x3a000
    SizeOfRawData : 0xa000
    PointerToRawData : 0x3a000
    PointerToRelocations : 0x0
    PointerToLinenumbers : 0x0
    NumberOfRelocations : 0x0
    NumberOfLinenumbers : 0x0
    Characteristics :
        0x0 : Reserved for future use
        0x40 : Contains initialized data
        0x40000000 : Can be read

If you want to check out more details on this update, check out the releases on my GitHub repo. I will start Phase 4 very soon. Ta ta!