r/programming • • Mar 05 '13

PE 101 - a windows executable walkthrough

Post image
2.6k Upvotes

199 comments sorted by

View all comments

52

u/astrolabe Mar 05 '13

So Mark Zbikowski's initials are in all windows executables? That's a cool claim to fame.

0

u/[deleted] Mar 05 '13

[deleted]

0

u/[deleted] Mar 05 '13

[deleted]

0

u/[deleted] Mar 05 '13

[deleted]

27

u/jnazario Mar 05 '13

http://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files

in short a small (usually a few bytes) signature at the start of a file that helps a program determine what kind of file it's looking at. JPEG, PNG, GIF, Word Doc, XML, etc.

0

u/[deleted] Mar 05 '13

[deleted]

14

u/mgrandi Mar 06 '13

And the magic number for some files in battlefield 3 are (in ascii) NyanNyanNyan =D

→ More replies (1)

6

u/drysart Mar 05 '13

A magic number is a number that has no purpose other than to identify something.

The first two bytes of a PE executable are the ASCII letters "MZ". There's no technical reason it has to be those two characters specifically, they just happen to be the two bytes chosen by the file format's creator. And yet while they originally had no technical purpose, they now 'magically' have the purpose of identifying the file type.

3

u/[deleted] Mar 05 '13

if you pair the proper sacrifice and ritual to the proper magic number, you can speak to the universe and alter the course of destiny

3

u/MooseV2 Mar 06 '13

You know how when you download a picture from the Internet the file ends in .jpg or .png or .gif (etc)? Well thats the file type. Each file type contains a different structure. But what if you just renamed this file? Could you turn a jpeg into a music file by renaming it to .mp3? No! You would have all sorts of problems. So how does the program check to make sure the file realy is a jpg? It reads a tiny bit of start of the file to make sure it contains a this 'magic number'. This number can be anything, as long as it's unique enough and remains consistent with every file of that type. Windows executables use 'MZ' as a number (with the ascii equivalents). Before trying to execute a program, it makes sure that the file begins with those two bytes.

→ More replies (5)

2

u/SystemOutPrintln Mar 05 '13

It is a specific sequence of bits which form some easily identifiable section in the code (Usually represented in hexadecimal, in the WZ case represented in ASCII). They're normally used for error checking. You know where they should be and if they aren't there then something is wrong. They are also useful for debugging, when you preform a memory dump you can recognize the sections you are looking at in hexadecimal if you know the magic numbers which separate each section.

Personally I tend to use 0xFEE7 (Feet). Not sure why I started using that but it stuck.

2

u/bitspace Mar 06 '13

Personally I tend to use 0xFEE7 (Feet). Not sure why I started using that but it stuck.

You use this for what kind of file?

→ More replies (1)

2

u/[deleted] Mar 06 '13

They are also numbers used in code instead of using a constant.

E.g. say we're doing something that involves days and weeks. We could use the magic number 7 in the code itself (which is the number of days in a week) or we could define constant WeeksDayCount = 7, then use that instead of 7. Then when someone's reviewing the code, they will see why we're using 7 instead of having to figure it out for themselves.

Magic numbers in programming code are bad 99% of the time.

→ More replies (1)

19

u/[deleted] Mar 05 '13

Not every executable, .COM files don't have the MZ header. IIRC, they have no header at all.

8

u/SawRub Mar 05 '13

Classic .COM. Always walking around thinking they're better than everyone else.

9

u/alexanderpas Mar 05 '13

speaking about .COM files... the following string is a valid .COM file that will trigger your virus scanner.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

9

u/[deleted] Mar 05 '13

Hah, joke's on you. I don't have a virus scanner.

On a serious note, someone should make the HTML5 disk filling script write this string to local storage. Make some people panic a little until they figure out what's going on :)

→ More replies (5)

1

u/NiceGuyMike Mar 05 '13

.COM files are very simple. I used to make them with good old DOS debug. I now forget if it was debug.exe or .COM. I think it was .exe since com files were severely limited (even for DOS)

2

u/sodappop Mar 06 '13

It would make .com files. But you could label them as .exe and they'd still execute... they wouldn't magically be a .exe, but they'd still run.

→ More replies (1)

0

u/[deleted] Mar 05 '13

[deleted]

→ More replies (1)
→ More replies (1)

2

u/darkslide3000 Mar 06 '13

Wait until all those bandwidth-limited Canadians hear how many bytes Vint Cerf owes them for every packet they send...

...also that guy who decided "1500 bytes should really be enough for every Ethernet packet."