Dissect Windows PE/COFF binaries, DLLs, and sys drivers in real time. Inspect DOS headers, section virtual/raw boundaries, compile timestamps, ASLR/DEP exploit mitigations, and calculate Shannon entropy per section to detect UPX packers, cryptors, and W^X memory violations.
Extracts headers, section boundaries, compile stamps, and calculates Shannon entropy on initial blocks in milliseconds. Zero bytes are uploaded or saved to any cloud infrastructure.
Virtual memory mapping vs. raw disk boundaries and calculated Shannon entropy (0.0 - 8.0).
| Section Name | Virtual Size | Virtual Address (RVA) | Raw Size (Disk) | Raw Offset | Permissions | Shannon Entropy | Forensic Status |
|---|
Scans for anomalies including W^X memory violations, known packer signatures, timestomping, and header misalignments.
| e_magic (Magic) | 0x5A4D (MZ) |
| e_cblp (Bytes on last page) | -- |
| e_cp (Pages in file) | -- |
| e_crlc (Relocations) | -- |
| e_cparhdr (Header paragraph size) | -- |
| e_lfanew (PE Header Offset) | -- |
| PE Signature | 0x00004550 (IMAGE_NT_SIGNATURE) |
| Machine Architecture | -- |
| NumberOfSections | -- |
| TimeDateStamp | -- |
| PointerToSymbolTable | -- |
| NumberOfSymbols | -- |
| SizeOfOptionalHeader | -- |
| Characteristics Flags | -- |
| Magic Format | -- |
| AddressOfEntryPoint | -- |
| ImageBase | -- |
| SectionAlignment | -- |
| FileAlignment | -- |
| SizeOfImage | -- |
| SizeOfHeaders | -- |
| Subsystem | -- |
| CheckSum | -- |
Pointers to the 16 standard PE table directories in memory.
| Index | Directory Name | Virtual Address (RVA) | Size (Bytes) | Section Location |
|---|
In digital forensics, malware reverse engineering, and threat triage, the Portable Executable (PE) format is the ubiquitous binary standard for Windows executable files (.exe), dynamic link libraries (.dll), kernel drivers (.sys), and control panel applets (.cpl). Designed by Microsoft as a derivation of the Common Object File Format (COFF), every Windows binary begins with an MS-DOS legacy stub and cascades into structural headers that dictate how Windows loads machine code into virtual memory.
Static analysis examines an executable without executing code, preserving sandbox environments and preventing triggering malicious kill-switches. Forensic examiners focus on five core structures:
Initiates with magic bytes 4D 5A (ASCII: MZ). At offset 0x3C sits the critical 4-byte pointer e_lfanew, specifying the exact byte offset where the true modern PE header begins.
Records the Unix epoch compilation timestamp. When attackers use timestomping utilities to forge creation dates (e.g. setting timestamps to 2012 or a date in 2038), the anomaly immediately surfaces in timeline cross-examinations.
Pointers in the PE header are Relative Virtual Addresses (RVA)—offsets from the base address in memory (ImageBase). Understanding RVAs allows investigators to locate the entry point and exported functions.
The DllCharacteristics word reveals whether ASLR (Address Space Layout Randomization), DEP/NX (Data Execution Prevention), and Control Flow Guard (CFG) were enabled by the compiler.
Claude Shannon's Entropy measures the statistical randomness and information density of a byte array on a scale from 0.0 to 8.0:
Entropy Threshold Scale: 0.0 - 5.0 (Plain text / padding) • 5.8 - 6.4 (Typical compiled x86/x64 machine code) • > 6.8 (Encrypted, compressed, or packed payloads)
Packers (such as UPX, Themida, ASPack, or custom obfuscators) compress the original binary code and wrap it in a tiny execution stub. When an examiner inspects the section headers, three tell-tale signatures emerge:
7.0 (often exceeding 7.8).UPX0 section often has a SizeOfRawData of 0 on disk, but a VirtualSize of hundreds of kilobytes, reserving uninitialized memory for runtime decompression.IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE, indicating self-modifying code.| Section Name | Standard Purpose | Normal Characteristics | Forensic Suspicion Flags |
|---|---|---|---|
| .text / CODE | Executable CPU instructions | Read, Execute (R-X) | Entropy > 6.8 or Writable (W) enabled |
| .data | Initialized global & static variables | Read, Write (RW-) | Executable (X) enabled or high entropy embedded payload |
| .rdata / .idata | Read-only constants, imports, strings | Read Only (R--) | Missing import directory or zero imports |
| .rsrc | Embedded application resources (icons, manifests) | Read Only (R--) | Embedded second PE binary disguised in raw RCDATA |
| .reloc | Base relocation table for ASLR rebasing | Read Only (R--) | Stripped relocations in a DLL (violates Windows standards) |
| UPX0 / UPX1 | Ultimate Packer for eXecutables compressed stub | Read, Write, Execute (RWX) | Definitive proof of binary compression |
IMAGE_SCN_MEM_WRITE (0x80000000) and IMAGE_SCN_MEM_EXECUTE (0x20000000) flags enabled, it represents a high-severity heuristic indicator of self-modifying code, an unpacking stub, or in-memory shellcode injection.
FileReader and DataView APIs. Zero bytes are uploaded or transmitted over the internet.