~/CSC 471/Class 04

CSC 471 · Class 04

The PE File Format

20 knowledge points. Work through them in order, or jump to any topic.

//

Knowledge Points

01Why Care About the PE Format? → 02PE File Layout at a Glance → 03The DOS Header (Legacy but Load-Bearing) → 04NT Headers: Signature + File Header + Optional Header → 05Optional Header: Where the Loader Looks → 06RVA vs File Offset → 07Converting RVA to File Offset → 08Worked Example: RVA to File Offset → 09The Section Table and Common Sections → 10Section Red Flags → 11Imports: How a PE Uses Other DLLs → 12Imports Reveal Capability → 13Exports: What a DLL Offers → 14Other Directories Worth Knowing → 15Tools for PE Analysis → 16A Tiny pefile Snippet → 17Packing and Entropy (Bridge to Dynamic Analysis) → 18Tie-In to Lab 1 → 19Summary → 20End of Class 04 →