PE x86 0 protection¶

RootMe challenge: PE x86 - 0 protection: This challenge comes from greHack CTF 2012.

Retrieve the password to validate this challenge.

Resources¶

• Microsoft Portable Executable and Common Object File Format Specification

• Reverse Engineering pour Débutants - Dennis Yurichev

• Introduction au format Portable Executable PE

• Reverse Engineering for Beginners - Dennis Yurichev

Counter moves¶

A zero-protection PE reads straight through. Stripping and packing are the cheap first steps. The defensive counterpart is in the blue notes on the application layer as a target.