I solved this to an extent. Currently we have build system that makes sure all new builds are on the path of constant length (builds/001, builds/002, etc), thus avoiding shifts in the PE layout. After build a tool compares old and new binaries ignoring relevant PE fields and other locations with known superficial changes. It … Read more
wmic datafile where name=”C:\\Windows\\System32\\msiexec.exe” get Version /value You can use wmic to do it. And you can wrap it into a batch file @echo off setlocal enableextensions set “file=%~1” if not defined file goto :eof if not exist “%file%” goto :eof set “vers=” FOR /F “tokens=2 delims==” %%a in (‘ wmic datafile where name^=”%file:\=\\%” get … Read more
As quoted from source (Creating the smallest possible PE executable): 1 Smallest possible PE file: 97 bytes Smallest possible PE file on Windows 2000: 133 bytes Smallest PE file that downloads a file over WebDAV and executes it: 133 bytes The files above are the smallest possible PE files due to requirements of the PE … Read more
The PE32 format stands for Portable Executable 32-bit, while PE32+ is Portable Executable 64-bit format. Please see this article for detailed info.
Most Windows process (*.exe) are loaded in (user mode) memory address 0x00400000, that’s what we call the “virtual address” (VA) – because they are visible only to each process, and will be converted to different physical addresses by the OS (visible by the kernel / driver layer). For example, a possible physical memory address (visible … Read more