securedorg.github.io/fundamentals2.md

layout, permalink, title

layout	permalink	title
default	/RE101/section1.2/	Fundamentals

Go Back to Reverse Engineering Malware 101

Section 1.2: Fundamentals

Anatomy of a Windows PE C program

Typical windows programs are in the Portable Executable (PE) Format. It’s portable because it contains information, resources, and references to dynamic-linked libraries (DLL) that allows windows to load and execute the machine code.

Windows Architecture

PE Header

Memory Layout

The Stack

Environment Setup <- Back | Next -> x86 Assembly