Lost in the Loader - The Many Faces of the Windows PE File Format

Explore a 25-minute Black Hat conference talk on parser differentials for the Windows PE file format. Dive into custom language development for creating formal models of PE loaders across various Windows versions and reverse-engineering tools. Learn about a framework that leverages these models to perform analyses aiding reverse-engineering tasks. Discover the intricacies of PE headers, section tables, and the subtle challenges within the PE ecosystem. Examine the implications of PE discrepancies, constraints modelling, and the language used for modelling constraints. Gain insights into the analysis framework's validation and generation modes, differential test case generation, and differences enumeration. Investigate memory mapping discrepancies, notable test cases, and the results of a malware hunt campaign. Presented by Dario Nisi, Mariano Graziano, Yanick Fratantonio, and Davide Balzarotti, this talk offers valuable takeaways for professionals working with Windows PE file formats and reverse engineering.