So in this video we'll be seeing about the optional header.
The name says optional, but it's mandatory for executables and errors.
So let's see the option here before we have seen this, uh, header and the dash up and here you can
see the 5045 represents the signature.
So here these four bytes are signature and the next 20 bytes, uh, specifies the file header.
So here in the paper, I have open this another character that you see because it's generated by Metasploit.
So this file header also gives the same information but in a meaningful format because it's going to
pass the values and gives you some meaning.
And the next 20 wide so 16 for so next 20 whites are the file header and the next 224 bytes.
So here you will have the file header size of option.
So this option header is the the size changes.
So the size of this option header is specified in this file header.
So that is to 40.
So you have 0 to 40.
So the size of the option header is to 40 bytes and starting from this point.
And here we have the first member.
So I am at the PIN work and here you can see if you search for option error.
We have two structures or image option 32 and image option 64.
So for now we'll be dealing with the 64 bits.
It's our most similar structure.
The only difference you get is the base of data.
So here you can see, uh, the base of code, base of data and image base.
So these are the members and this image image base is the base address preferred or assumed base address
of this executable.
So that means this image based value in the option header, let's say, uh, where is this one?
So this 14 zeros.
So this address is assumed as the base address and compiler will give you that basis for the hardcoded
values.
Suppose there are some.
Uh.
Like pointers to some integers.
So lets say those pointers will get the value from the this image based and if this executable is loaded
at another image base then you need to fix those addresses.
So that will be using the we'll be fixing the base relocations, so we'll be talking about that in the
upcoming videos.
So for now, let's, uh, just, uh, follow through this.
Uh.
These members.
So you will get only the difference at this image base.
So here it is for whites.
You can see field of 28 and 32.
The next number starts.
So the four bytes and here you don't have the size of a base of data.
You have this image base that is eight bytes because it's a 64 bit.
So the first one is, uh, 002.
And if you go to P file format and you have this Microsoft website.
And here you can see the magic number.
So this is also magic number that defines the whether the executable is 32 bit or 64.
And here you can see the value is 20 B and it has been passed and it is 64.
So this will be using this number to.
Identify whether it's 32 bit or 64 bit executable.
And the next one is, uh, linker aversions and the size of code, size of all code sections.
So generally there will be or the code will be merged into the one section, vertex section.
If you have multiple sections, then all of the those sizes combined will be told here and so is the
initial data.
If there are there are any initial data and each is an initialized data and entry point.
So this one is also, uh, important, this is the offset to this base address.
Where is this one?
So if you go and click here, this will point directly to this one.
And this is the entry point execution of the first instruction.
Okay.
And the base of code and image base.
So this.
Is the preferred image based.
Will we see?
We'll be loading our executable in the, uh, some random images.
And we also fix inputs and basically locations.
And this is the section element.
So this is also important.
So what?
This sexual harassment meanies.
Section 11 Values thousand.
So that means each section should start at multiples of this 1000 hexadecimal only.
Suppose if there is a section dot test one and it starts at 2000 heads.
So and the size.
Of test, one section is only.
I'd say 500 hexadecimal, uh, bytes, so.
Then if there is another textual to section and this section should not start it to FY zero one, it
should start at 3000 H because the multiples of uh, this thousand H uh, that is the rule for the section
element.
So this is called section alignment.
The sections should start at the multiples of this value only.
In the same way file arrangement.
So this action element is in the memory and this file element is when the file is on the right disk
or if you go to sections and here you can see here raw addresses or addresses follows these file alignment.
You can see 416 hundred, 8000.
These are all multiples of 200.
So what is my version?
Minor version and subsystem.
And Subsystem also tells us whether it's a GWI or a console application and size of image.
So size of images, total size of the image in memory, not on disk but in memory and size of headers.
So size of headers is total size of all headers combined except the actual data.
So we have seen does header this dash top and the file header optional header section headers.
So if you combine all of these sizes, that is the size of all headers to 48 hexadecimal.
And the other characteristics.
And of stack reserve and commit.
And one other important thing is a lot of flags.
So these are badges can be given when you are creating the threat will see there and a lot of flags
should be zero.
You can see, uh, if, uh, some malware can have these red flags set to some, uh, random value.
When this red flags is set to some random value.
Um, some is just run this binary.
So there are all, there is a old version of, uh, dpkg.
It's whenever this red flags is set to some random value, it just runs the executable and you get infected
a number of ah here and say this.
So up to here we have normal members and from here onwards, uh, these Occupy 128 bytes, I think.
124 bytes.
So you can subtract this 14 C -0.
14.
C minus.
E zero.
I think.
148.
So the next are the the image data directories.
So you can see the values, but it's very impossible.
To attend everything.
Because that's why I'm using this p.
So these are the image data territories and these are the payers.
So we have the virtual address and the size of this data directory.
So we can search for this.
Image data directory.
So it means that the data sets are contains to members what you your address and the size.
So there is an export directory and the virtual address and zero.
So this is the XY and XY does not do any export.
So that's why we.
I don't have any exports and the import directory so the executable import something import some functions
from the dealers and the starting import will be pointed to this one.
So the that import is import uh descriptor and the first uh import descriptor will be pointed by this
address.
And if you go to this one and you go to this exact, uh, structure, so we'll be parsing this, uh,
later, just for now, uh, understand that this points to the first, uh, uh, image import descriptor.
And the size of this territory the the seas six sea and we have zero so that is we don't that is there
are no those territories and we have a base relocation table.
Uh, we, we also passing, uh, and updating the base addresses and we have email address table.
So we are also fixing this one.
So that's how about this option?
This is a very important header for the P file.