So in this video we are going to learn about that.
B File format.
B stands for portable executable.
So in our day to day life, we will be using the X files on the computer.
So we are also using their data files.
So obviously the U.S. files will use the functions from their data for execution.
So these come under the file format that is portable executable.
So their name given based on the portability.
So if you compare one binary to Windows seven.
And if you run that in Windows eight, so it will obviously execute.
So that way there is a portability among the Windows systems are not cross-platform.
That's where the name portability girl has given.
So we are going to see in the hex editor and also will be using that to our period.
There are so many tools that will pass the hour before and read through the contents from that.
BATES So you will be seeing the people that first will be opening the fire in Exeter.
So.
So we'll be using your normal XY file.
And all of these headers are defined in this benign pilot hedge.
So you can download this file from this manga for business.
So after downloading that, you can open this in your code.
And the first one is the DOS.
Head of the first four bytes is the header.
So each row consists of 16, right?
So you can define the first two rows as the two.
So we can also see if the file format.
Images if you go to the images and.
So here you can see the first one is the Darth Vader.
That is the first 64 bit.
So this method is not clear.
So.
Okay.
This?
Oh, yeah, this is fine.
The first one is the.
Does it hurt a?
For 64 bytes.
You can also search here.
Image does header.
You're going to see the are the members of this.
Does her who will not be covering all of these members?
Only the important ones will recover.
The first one is the magic the magic number for the fire.
And we will be also seeing another magic number in nine other heads.
So we'll be discussing in an upcoming videos.
So for now, yes, this one is the magic number.
So the word word is the two bytes and the D word is the double.
What that means to read it is for white.
So magic is five for B.
So these are in the white under.
So the magic number will be five for the.
And if you just identify it, you can see in the ASCII text, I'm there.
So this can be this is a magic phone for that.
A magic number for the beaver for.
So the next feature will be discussing is the elephant you.
So this can be.
This is the pointer to the P here to.
So here you can see there is a dustup.
This is the dustup here.
You can see this from 0200.
So what this does is whenever you wrote this before in that mess, does this string reprinted on the
council?
The program cannot be run under the dance mode.
I should be run in only in the Microsoft Windows.
So that is the purpose of this raster.
So whenever the Windows are this elephant, you is the pointer to the P here.
So this last member will point to the B and here you can see the value is.
Rushed to for whites because it's their before.
And if you reverse from right to left, you'll be getting.
You will be getting 000000080.
So if you go to this address and here you can see on the left hand side, this is the address and we
have the starting address and the contents are the first, uh, uh, d what is the P which defines this
is the P.
In some cases the program is covered under Microsoft or Rinker.
Then there would be some garbage in between this dos and the B header.
So that garbage really has some X are key.
So you need to exert that data with that to take some field.
After that, you'll be getting the information on what system it has compiled and what are the versions
of the linker, etc..
So in our world we don't have that we have only the doorstep does header dust up and the be here to.
So the first number is the signature.
And the second memories, the fighting and the memories, too.
So you can search for this image, image and the score.
Image via the header.
So if you go up.
So this.
Sorry, this is.
Are in theaters.
Uh, I'm searching for another name for that.
So image be here.
Here's.
This is the here and the first member is the B word and this is the signature.
So the first four bytes includes the signature.
So the first four waits are 00004 550.
So this contributes the basking sharks B, which defines the P for.
And the next one is the structure image file header.
So if I go and search for these.
And here we can see the structure so we can estimate the size.
Are two whites, four whites who are 16, 18, 20.
So they fight harder or continue to quantity whites.
So 20 points from this 40.
So these are that were bites.
And here you can see up to the next day debates contribute to that fight.
So the first one is the machine.
So this indicates.
To which CBO type this has come.
Why I search for a machine.
I'll go to this machine, babes, and you can see the various machine types and their values.
Here we how uh, the machine is of also 014c.
014.
Now I'm going to copy this one and Sachin this zero one for.
Okay.
So we got this.
So image file machine I interpret is excited about this.
So this is converting this as a little bit.
Uh.
XY.
That is the number machine and the number of sections you can see the number of sections is defined
here.
These.
You can tell the number of sections from this field.
That is the word which is 0003.
So against concerned number our sections zero.
So there are three sections.
We'll be discussing those sections in the upcoming videos and then actually use our time date stamp.
The next lever.
So this is a unique epoch.
You need to convert that into
actual human readable format.
So we have the condensed by 6440780.
So for this binary, I'm getting the wrong where you hope to convert to 60.
So convert this copy this one uniques about timestamp.
Go to this website and paste here and convert to here.
You can see the year 2066.
Okay.
So.
I don't know why this I was compelled in the research to your doctrinal framework.
Maybe it has put some wrong information there.
So anyway, that is the timestamp.
So we can obviously view another file here.
Simply you can open this selector and see the timestamp values.
So next we will be having some fun under the multiverse, embarrassed etc..
So any debugging information and the.
Size up, often unheard of.
So this is important here because the option I have, the, uh, the size is the dynamic.
So generally it will be 24, right?
It can vary.
So that's why the size of this option header is defined in this file header, not single parent.
So this is the last penultimate word.
So this you can see this one, these two bytes, ee0g regular.
So that is size of option here is 000.
So reduced to 24 bytes.
And the last one is characteristics.
It will define the fire characteristics, whether it's uh.
Uh.
The variable.
Uh.
You can see the characteristics of whether it's a executable image or it has the debugging symbol,
strip, etc..
So let's see what our value has.
We have the world that is this one and this one, two bytes.
So that is 0022.
So we can search for the rights to do.
Do you see the flags, flag values you need to add them.
So 20.
So we have image file at the address aware and add this.
So image file executable image.
So our application can handle are does this and also the it is an executable because it's a.
So these are the headlines we have covered in this video.
First one is the does header, first to 64 bytes.
And the next one is the following.
Uh, does Heather.
And the next one is a signature piece.
Signature.
And the next one is the final head of.
Which contains the machine numbers, actions, timestamp size and characteristics.
So let's go and load this in the B parser.
Bieber.
Here.
You can see it whenever you load this.
Here you have the nice tree structure, the center.
If you go and click on this, it will take me to the first bite for Defi that we have seen in the accelerator.
And here you have a general information.
It also has this disassembly.
And the dust header.
You can see all of the members and their values.
So this people will take these.
According to the site, this site's magic number is the water.
So it will go and pass the content.
You can see this has already written the bytes from returning to normal.
540.
And here you can see the fire at resolve you see here.
So for going through this, I'll be taken to this address.
Would you ever be here?
So if I go click on this so you can see the first addresses and the be.
We can also pick on this offset.
Right.
Click on this.
You need to make sure to follow on.
And the fighter header, we have the machine.
So it also this application also decodes the value for BNC.
So it will see this lookup table and convert this into a meaningful format.
And there are three sections and the timestamp it also converted to 2066.
And so the size of option for weights and characteristics 22.
So the two used for executable and application and.
So again, so far, this video will cover the dance, her dance, the signature and the fight.