Getting started with the portable executable file format

Understanding file formats is essential to being able to analyze them effectively. Microsoft's portable executable, commonly known as PE, is one of the largest on the market because it contains executable code for the Windows operating system. In this session, we'll look at the basics of this binary file format by first creating sample programs and then analyzing them using a hex editor. We will identify common characteristics of PE files, those often used in signatures, and begin to explore the internal data structures. We'll also begin to explore the differences between these files when they reside on disk and when they are loaded into memory for execution. So dust off that hex editor and join me as we start to scratch the surface of the PE file format!

Please take the opportunity to connect and share this video with your friends and family if you find it useful.