Switch branches/tags
Nothing to show
Find file History
Latest commit af2e1a0 Mar 26, 2015
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
bin Moved stuff to PE Mar 26, 2015
96emptysections.asm Moved stuff to PE Mar 26, 2015
96workingsections.asm Moved stuff to PE Mar 26, 2015
appendeddata.asm Moved stuff to PE Mar 26, 2015
appendedhdr.asm Moved stuff to PE Mar 26, 2015
appendedsecttbl.asm Moved stuff to PE Mar 26, 2015
apphdrw7.asm Moved stuff to PE Mar 26, 2015
appsectableW7.asm Moved stuff to PE Mar 26, 2015
aslr-ld.asm Moved stuff to PE Mar 26, 2015
aslr.asm Moved stuff to PE Mar 26, 2015
bigSoRD.asm Moved stuff to PE Mar 26, 2015
bigalign.asm Moved stuff to PE Mar 26, 2015
bigib.asm Moved stuff to PE Mar 26, 2015
bigsec.asm Moved stuff to PE Mar 26, 2015
bottomsecttbl.asm Moved stuff to PE Mar 26, 2015
cfgbogus.asm Moved stuff to PE Mar 26, 2015
code_printf.inc Moved stuff to PE Mar 26, 2015
code_printf64.inc Moved stuff to PE Mar 26, 2015
compiled.asm Moved stuff to PE Mar 26, 2015
consts.inc Moved stuff to PE Mar 26, 2015
copyright.asm Moved stuff to PE Mar 26, 2015
ctxt-ld.asm Moved stuff to PE Mar 26, 2015
ctxt.asm Moved stuff to PE Mar 26, 2015
d_nonnull-ld.asm Moved stuff to PE Mar 26, 2015
d_nonnull.asm Moved stuff to PE Mar 26, 2015
d_resource-ld.asm Moved stuff to PE Mar 26, 2015
d_resource.asm Moved stuff to PE Mar 26, 2015
d_tiny-ld.asm Moved stuff to PE Mar 26, 2015
d_tiny.asm Moved stuff to PE Mar 26, 2015
dd_dll.inc Moved stuff to PE Mar 26, 2015
dd_imports.inc Moved stuff to PE Mar 26, 2015
ddsect.asm Moved stuff to PE Mar 26, 2015
debug.asm Moved stuff to PE Mar 26, 2015
delaycorrupt.asm Moved stuff to PE Mar 26, 2015
delayfake.asm Moved stuff to PE Mar 26, 2015
delayimports.asm Moved stuff to PE Mar 26, 2015
dep.asm Moved stuff to PE Mar 26, 2015
dll-dynld.asm Moved stuff to PE Mar 26, 2015
dll-dynunicld.asm Moved stuff to PE Mar 26, 2015
dll-ld.asm Moved stuff to PE Mar 26, 2015
dll-webdavld.asm Moved stuff to PE Mar 26, 2015
dll.asm Moved stuff to PE Mar 26, 2015
dllbound-ld.asm Moved stuff to PE Mar 26, 2015
dllbound-redirld.asm Moved stuff to PE Mar 26, 2015
dllbound-redirldXP.asm Moved stuff to PE Mar 26, 2015
dllbound.asm Moved stuff to PE Mar 26, 2015
dllbound2.asm Moved stuff to PE Mar 26, 2015
dllcfgdup-dynld.asm Moved stuff to PE Mar 26, 2015
dllcfgdup.asm Moved stuff to PE Mar 26, 2015
dllemptyexp-ld.asm Moved stuff to PE Mar 26, 2015
dllemptyexp.asm Moved stuff to PE Mar 26, 2015
dllextep-ld.asm Moved stuff to PE Mar 26, 2015
dllextep.asm Moved stuff to PE Mar 26, 2015
dllfakess-dynld.asm Moved stuff to PE Mar 26, 2015
dllfakess-ld.asm Moved stuff to PE Mar 26, 2015
dllfakess.asm Moved stuff to PE Mar 26, 2015
dllfw-ld.asm Moved stuff to PE Mar 26, 2015
dllfw.asm Moved stuff to PE Mar 26, 2015
dllfwloop-ld.asm Moved stuff to PE Mar 26, 2015
dllfwloop.asm Moved stuff to PE Mar 26, 2015
dllmaxvals-dynld.asm Moved stuff to PE Mar 26, 2015
dllmaxvals-ld.asm Moved stuff to PE Mar 26, 2015
dllmaxvals.asm Moved stuff to PE Mar 26, 2015
dllnegep-ld.asm Moved stuff to PE Mar 26, 2015
dllnegep.asm Moved stuff to PE Mar 26, 2015
dllnoexp-dynld.asm Moved stuff to PE Mar 26, 2015
dllnoexp.asm Moved stuff to PE Mar 26, 2015
dllnomain-ld.asm Moved stuff to PE Mar 26, 2015
dllnomain.asm Moved stuff to PE Mar 26, 2015
dllnomain2-dynld.asm Moved stuff to PE Mar 26, 2015
dllnomain2.asm Moved stuff to PE Mar 26, 2015
dllnoreloc-ld.asm Moved stuff to PE Mar 26, 2015
dllnoreloc.asm Moved stuff to PE Mar 26, 2015
dllnullep-dynld.asm Moved stuff to PE Mar 26, 2015
dllnullep-ld.asm Moved stuff to PE Mar 26, 2015
dllnullep.asm Moved stuff to PE Mar 26, 2015
dllord-ld.asm Moved stuff to PE Mar 26, 2015
dllord.asm Moved stuff to PE Mar 26, 2015
dllweirdexp-ld.asm Moved stuff to PE Mar 26, 2015
dllweirdexp.asm Moved stuff to PE Mar 26, 2015
dosZMXP.asm Moved stuff to PE Mar 26, 2015
dotnet.inc Moved stuff to PE Mar 26, 2015
dotnet20.asm Moved stuff to PE Mar 26, 2015
driver.asm Moved stuff to PE Mar 26, 2015
dump_imports.asm Moved stuff to PE Mar 26, 2015
duphead.asm Moved stuff to PE Mar 26, 2015
dupsec.asm Moved stuff to PE Mar 26, 2015
exceptions.asm Moved stuff to PE Mar 26, 2015
exe2pe.asm Moved stuff to PE Mar 26, 2015
exportobf.asm Moved stuff to PE Mar 26, 2015
exports_doc.asm Moved stuff to PE Mar 26, 2015
exports_order.asm Moved stuff to PE Mar 26, 2015
exports_std.inc Moved stuff to PE Mar 26, 2015
exportsdata.asm Moved stuff to PE Mar 26, 2015
fakenet.asm Moved stuff to PE Mar 26, 2015
fakeregs.asm Moved stuff to PE Mar 26, 2015
fakeregslib.asm Moved stuff to PE Mar 26, 2015
fakerelocs.asm Moved stuff to PE Mar 26, 2015
foldedhdr.asm Moved stuff to PE Mar 26, 2015
foldedhdrW7.asm Moved stuff to PE Mar 26, 2015
footer.asm Moved stuff to PE Mar 26, 2015
gpa.inc Moved stuff to PE Mar 26, 2015
gpa_ebp.inc Moved stuff to PE Mar 26, 2015
gui.asm Moved stuff to PE Mar 26, 2015
hard_imports.asm Moved stuff to PE Mar 26, 2015
hdrcode.asm Moved stuff to PE Mar 26, 2015
hdrdata.asm Moved stuff to PE Mar 26, 2015
headers.inc Moved stuff to PE Mar 26, 2015
headers64.inc Moved stuff to PE Mar 26, 2015
headers_dll.inc Moved stuff to PE Mar 26, 2015
helloworld-X.pdf Moved stuff to PE Mar 26, 2015
hiddenappdata1.asm Moved stuff to PE Mar 26, 2015
hiddenappdata2.asm Moved stuff to PE Mar 26, 2015
ibkernel.asm Moved stuff to PE Mar 26, 2015
ibkmanual.asm Moved stuff to PE Mar 26, 2015
ibknoreloc64.asm Moved stuff to PE Mar 26, 2015
ibnullXP.asm Moved stuff to PE Mar 26, 2015
ibreloc.asm Moved stuff to PE Mar 26, 2015
ibrelocW7.asm Moved stuff to PE Mar 26, 2015
icon.bin Moved stuff to PE Mar 26, 2015
impbyord.asm Moved stuff to PE Mar 26, 2015
imports.asm Moved stuff to PE Mar 26, 2015
imports_apimsW7.asm Moved stuff to PE Mar 26, 2015
imports_badterm.asm Moved stuff to PE Mar 26, 2015
imports_bogusIAT.asm Moved stuff to PE Mar 26, 2015
imports_corruptedIAT.asm Moved stuff to PE Mar 26, 2015
imports_iatindesc.asm Moved stuff to PE Mar 26, 2015
imports_mixed.asm Moved stuff to PE Mar 26, 2015
imports_multidesc.asm Moved stuff to PE Mar 26, 2015
imports_nnIAT.asm Moved stuff to PE Mar 26, 2015
imports_noext.asm Moved stuff to PE Mar 26, 2015
imports_noint.asm Moved stuff to PE Mar 26, 2015
imports_nothunk.asm Moved stuff to PE Mar 26, 2015
imports_printfexitprocess.inc Moved stuff to PE Mar 26, 2015
imports_printfexitprocess64.inc Moved stuff to PE Mar 26, 2015
imports_relocW7.asm Moved stuff to PE Mar 26, 2015
imports_tinyW7.asm Moved stuff to PE Mar 26, 2015
imports_tinyXP.asm Moved stuff to PE Mar 26, 2015
imports_virtdesc.asm Moved stuff to PE Mar 26, 2015
imports_vterm.asm Moved stuff to PE Mar 26, 2015
importsdotXP.asm Moved stuff to PE Mar 26, 2015
importshint.asm Moved stuff to PE Mar 26, 2015
ldrsnaps.asm Moved stuff to PE Mar 26, 2015
ldrsnaps64.asm Moved stuff to PE Mar 26, 2015
lfanew_relocW7.asm Moved stuff to PE Mar 26, 2015
lfanew_relocXP.asm Moved stuff to PE Mar 26, 2015
lowaldiff.asm Moved stuff to PE Mar 26, 2015
lowsubsys.asm Moved stuff to PE Mar 26, 2015
manifest.asm Moved stuff to PE Mar 26, 2015
manifest_broken.asm Moved stuff to PE Mar 26, 2015
manifest_bsod.asm Moved stuff to PE Mar 26, 2015
manyimportsW7.asm Moved stuff to PE Mar 26, 2015
maxsecW7.asm Moved stuff to PE Mar 26, 2015
maxsecXP.asm Moved stuff to PE Mar 26, 2015
maxsec_lowaligW7.asm Moved stuff to PE Mar 26, 2015
maxvals.asm Moved stuff to PE Mar 26, 2015
memshared-ld.asm Moved stuff to PE Mar 26, 2015
memshared.asm Moved stuff to PE Mar 26, 2015
mini.asm Moved stuff to PE Mar 26, 2015
mkpe.py Moved stuff to PE Mar 26, 2015
mkpe_lowalg.py Moved stuff to PE Mar 26, 2015
mscoree.asm Moved stuff to PE Mar 26, 2015
multiss.asm Moved stuff to PE Mar 26, 2015
mz.asm Moved stuff to PE Mar 26, 2015
namedresource.asm Moved stuff to PE Mar 26, 2015
no0code.asm Moved stuff to PE Mar 26, 2015
no_dd.asm Moved stuff to PE Mar 26, 2015
no_dd64.asm Moved stuff to PE Mar 26, 2015
no_dep.asm Moved stuff to PE Mar 26, 2015
no_seh.asm Moved stuff to PE Mar 26, 2015
normal.asm Moved stuff to PE Mar 26, 2015
normal64.asm Moved stuff to PE Mar 26, 2015
nosectionW7.asm Moved stuff to PE Mar 26, 2015
nosectionXP.asm Moved stuff to PE Mar 26, 2015
nothing-ld.asm Moved stuff to PE Mar 26, 2015
nothing.asm Moved stuff to PE Mar 26, 2015
nthd_dll.inc Moved stuff to PE Mar 26, 2015
nthd_std.inc Moved stuff to PE Mar 26, 2015
nullEP.asm Moved stuff to PE Mar 26, 2015
nullSOH-XP.asm Moved stuff to PE Mar 26, 2015
nullvirt.asm Moved stuff to PE Mar 26, 2015
ownexports.asm Moved stuff to PE Mar 26, 2015
ownexports2.asm Moved stuff to PE Mar 26, 2015
ownexportsdot.asm Moved stuff to PE Mar 26, 2015
pdf.asm Moved stuff to PE Mar 26, 2015
pdf_zip_pe.asm Moved stuff to PE Mar 26, 2015
pdf_zip_pe.pdf Moved stuff to PE Mar 26, 2015
quine.asm Moved stuff to PE Mar 26, 2015
readme.txt Moved stuff to PE Mar 26, 2015
reloc4.asm Moved stuff to PE Mar 26, 2015
reloc9.asm Moved stuff to PE Mar 26, 2015
relocOSdet.asm Moved stuff to PE Mar 26, 2015
reloccrypt.asm Moved stuff to PE Mar 26, 2015
reloccryptW8.asm Moved stuff to PE Mar 26, 2015
reloccryptXP.asm Moved stuff to PE Mar 26, 2015
relocsstripped.asm Moved stuff to PE Mar 26, 2015
relocsstripped64.asm Moved stuff to PE Mar 26, 2015
reshdr.asm Moved stuff to PE Mar 26, 2015
resource.asm Moved stuff to PE Mar 26, 2015
resource2.asm Moved stuff to PE Mar 26, 2015
resource_icon.asm Moved stuff to PE Mar 26, 2015
resource_string.asm Moved stuff to PE Mar 26, 2015
resourceloop.asm Moved stuff to PE Mar 26, 2015
safeseh.asm Moved stuff to PE Mar 26, 2015
safeseh_fly.asm Moved stuff to PE Mar 26, 2015
sc.asm Moved stuff to PE Mar 26, 2015
secinsec.asm Moved stuff to PE Mar 26, 2015
section_1fa.inc Moved stuff to PE Mar 26, 2015
seh_change64.asm Moved stuff to PE Mar 26, 2015
shuffledsect.asm Moved stuff to PE Mar 26, 2015
signature.asm Moved stuff to PE Mar 26, 2015
signature.bin Moved stuff to PE Mar 26, 2015
skippeddynbase.asm Moved stuff to PE Mar 26, 2015
slackspace.asm Moved stuff to PE Mar 26, 2015
ss63.asm Moved stuff to PE Mar 26, 2015
ss63nocookie.asm Moved stuff to PE Mar 26, 2015
standard.asm Moved stuff to PE Mar 26, 2015
tiny.asm Moved stuff to PE Mar 26, 2015
tinyW7.asm Moved stuff to PE Mar 26, 2015
tinyW7_3264.asm Moved stuff to PE Mar 26, 2015
tinyW7x64.asm Moved stuff to PE Mar 26, 2015
tinyXP.asm Moved stuff to PE Mar 26, 2015
tinydll-ld.asm Moved stuff to PE Mar 26, 2015
tinydll.asm Moved stuff to PE Mar 26, 2015
tinydllXP-ld.asm Moved stuff to PE Mar 26, 2015
tinydllXP.asm Moved stuff to PE Mar 26, 2015
tinydrivXP.asm Moved stuff to PE Mar 26, 2015
tinygui.asm Moved stuff to PE Mar 26, 2015
tinynet.asm Moved stuff to PE Mar 26, 2015
tls.asm Moved stuff to PE Mar 26, 2015
tls64.asm Moved stuff to PE Mar 26, 2015
tls_aoi.asm Moved stuff to PE Mar 26, 2015
tls_aoiOSDET.asm Moved stuff to PE Mar 26, 2015
tls_exiting.asm Moved stuff to PE Mar 26, 2015
tls_import.asm Moved stuff to PE Mar 26, 2015
tls_k32.asm Moved stuff to PE Mar 26, 2015
tls_noEP.asm Moved stuff to PE Mar 26, 2015
tls_obfuscation.asm Moved stuff to PE Mar 26, 2015
tls_onthefly.asm Moved stuff to PE Mar 26, 2015
tls_reloc.asm Moved stuff to PE Mar 26, 2015
tls_virtEP.asm Moved stuff to PE Mar 26, 2015
truncatedlast.asm Moved stuff to PE Mar 26, 2015
truncsectbl.asm Moved stuff to PE Mar 26, 2015
version_cust.asm Moved stuff to PE Mar 26, 2015
version_mini.asm Moved stuff to PE Mar 26, 2015
version_std.asm Moved stuff to PE Mar 26, 2015
virtEP.asm Moved stuff to PE Mar 26, 2015
virtgap.asm Moved stuff to PE Mar 26, 2015
virtrelocXP.asm Moved stuff to PE Mar 26, 2015
virtsectblXP.asm Moved stuff to PE Mar 26, 2015
weirdsord.asm Moved stuff to PE Mar 26, 2015
winver.asm Moved stuff to PE Mar 26, 2015

readme.txt

this is Corkami PE files corpus:
a set of handmade files showing the various possibilities of the Portable Executable format,
under Windows.

All these files are clean and working.
However, they are hand-made and push the PE file format to its limits,
so they might be detected as malicious or as corrupted files.

it's documented at http://pe.corkami.com

Ange Albertini
@angealbertini (@corkami for news only)

BSD Licence, 2009-2013

Ranking (YMMV)
*.. = common
**. = non-standard
*** = complex


 *.. compiled.exe             complete PE example, as if compiled via MASM, including RichHeader, full headers + dos stub...

 *.. normal.exe               a 'normal' PE - sections, code, imports. Header is not full
 *.. normal64.exe              64b version

 **. mini.exe                 a PE defined with as few elements as possible (alignments = 1/1)

 **. bigalign.exe             big alignments (10000h/20000000h)
 **. bigib.exe                IMAGEBASE equ 7efd0000h ; 7ffd0000h also works under XP
 **. bigsec.exe               PE with virtually big section (0x10001000)
 **. bigSoRD.exe              PE with oversized SizeOfRawData (0xFFFF0200)
 **. bottomsecttbl.exe        section table at the bottom of the PE

 *.. lowsubsys.exe            a PE with a subsystem version of 3.10

 **. 65535sects.exe           65536 physical sections, all executed

 **. 96emptysections.exe      PE with 96 sections (95 empty sections)
 **. 96workingsections.exe    PE with 96 code sections, fully used

 *.. appendeddata.exe         a PE with appended data
 **. appendedhdr.exe          PE with NT headers in appended data (in extended header via SizeOfHeader)
 **. apphdrW7.exe             PE with NT headers in appended data (W7)
 **. appendedsecttbl.exe      section table outside the PE, in appended data (but in the header itself, for XP compatibility)
 **. appsectableW7.exe        unlike XP, the header doesn't need to be extended until the bottom of the file !W8

 **. footer.exe               NT Headers at the bottom of the file

 *** ctxt.dll                 a DLL modifying the caller's context via lpvReserved
      ctxt-ld.exe                loader

EntryPoint
 **. nullEP.exe               PE with null EntryPoint (MZ is executed as dec ebp, pop edx)
 *** virtEP.exe               PE with EntryPoint in virtual space (there will be a virtual 00 before the first physical C0, so 00C0 will be executed as `add al, al`)

DLL: (relocations, EntryPoint...)
 *.. dll.dll                  a simple DLL with relocations
      dll-ld.exe               static loader
      dll-dynld.exe            dynamic loader
      dll-dynunicld.exe        dynamic unicode loader
 **.  dll-webdavld.exe         WEBDav loader

 **. dllemptyexp.dll          DLL with empty export name
      dllemptyexp-ld.exe        loader

 **. dllextep.dll             DLL with no relocations for external EntryPoint execution
      dllextep-ld.exe          loader

 *.. dllfw.dll                forwarding DLL with minimal export table, and relocations
      dllfw-ld.exe              loader

 **. dllfwloop.dll            forwarding DLL with forwarding loop
      dllfwloop-ld.exe          loader

 **. dllnegep.dll             DLL with a negative entrypoint - that is *NOT* called
      dllnegep-ld.exe           loader

 **. dllnoexp.dll             DLL with no export tables, only DLL main
      dllnoexp-dynld.exe        loader

 *** dllnomain.dll            a DLL with no DLLMain (no IMAGE_FILE_DLL)
      dllnomain-ld.exe          static loader
 *** dllnomain2.dll           a DLL with no DLLMain (no IMAGE_FILE_DLL), and no imports (to be loaded dynamically)
      dllnomain2-dynld.exe      dynamic loader

 **. dllnoreloc.dll           DLL with no relocations (unneeded)
      dllnoreloc-ld.exe         loader

 **. dllnullep.dll            DLL with a null entrypoint - that is *NOT* called
      dllnullep-ld.exe         static loader
      dllnullep-dynld.exe      dynamic loader

 **. dllfakess.dll            a DLL with a fake subsystem
      dllfakess-ld.exe         static loader
      dllfakess-dynld.exe      dynamic loader

 **. dllmaxvals.dll           a DLL with maximum values
      dllmaxvals-ld.exe        static loader
      dllmaxvals-dynld.exe     dynamic loader

 **. dllcfgdup.dll            a DLL using Guard ControlFlow, but with duplicate entry
      dllcfgdup-dynld.exe      dynamic loader

 **. cfgbogus.exe             a PE with a bogus ControlFlow Guard table (Subsystem version too old)

Subsystems
 *.. gui.exe                  a simple GUI PE
 **. driver.sys               a simple driver (section, relocation, imports, checksum)

 *** multiss.exe              a multi-subsystem PE (that displays a message) no matter what its subsystem is set to.
      multiss_con.exe          console !W8
      multiss_gui.exe          gui !W8
      multiss_drv.sys          driver

 *.. aslr.dll                 a DLL with DYNAMIC_BASE set and used
      aslr-ld.exe              loader
 **. skippeddynbase.exe       a PE with ignored DYNAMIC_BASE, because RELOCS_STRIPPED is set

Section table (PE Geometry):
 **. duphead.exe              a PE with a section mapping the header
 **. dupsec.exe               a PE with several sections with the same physical space, and the header too

 *** foldedhdr.exe            NT headers is partially overwritten by section space, as if the sections were folded back on the header.
 *** foldedhdrW7.exe          Windows 7 version

 **. hiddenappdata1.exe       a PE with appended data hidden by an extra almost virtual section
 **. hiddenappdata2.exe       a PE with appended data hidden by an enlarged last section

 **. truncatedlast.exe        last section truncated
 **. truncsectbl.exe          section table is truncated by sizeofheaders
 **. shuffledsect.exe         a PE with sections in wrong order in the section table
 **. slackspace.exe           slack space between sections
 **. secinsec.exe             a PE with a small section physically inside a bigger one
 **. virtgap.exe              a PE with a huge virtual gap between physical section
 *** virtsectblXP.exe         with 85 sections, with the section table outside the file

 **. maxsec_lowaligW7.exe     Low Alignment PE for Vista-W7, with 6666 sections
 **. maxsecW7.exe             PE with 8192 used code sections
 **.  maxsecXP.exe             Low Alignment PE for XP, with 96 sections

 **. no_dd.exe                a PE without any data directory (loading imports manually) !W8
 **. no_dd64.exe               64b version
 **. no0code.exe              no null before code ends => headers are relocated far enough so that e_lfanew contains no 0 !W8
 **. nosectionW7.exe          Low Alignment PE for , with no section !W8
      nosectionXP.exe          XP version

 *** nothing.dll              a DLL with code and no sections, no EntryPoint, no imports (crashing w/W8)
      nothing-ld.exe           loader

 **. nullSOH-XP.exe           null SizeOfOptionalHeader which means the Section table is overlapping the Optional header (XP only)
 *.. nullvirt.exe             a PE with a virtually null section

 **. tinyXP.exe               a tiny PE: sectionless, PE header overlapping dos headers, truncated optional header, 97 bytes XP only.
 **. tinydll.dll              same thing, DLL version
      tinydll-ld.exe            loader
 **. tinydllXP.dll              same thing, XP version
      tinydllXP-ld.exe            loader
 **. tinydrivXP.sys           same thing, driver version
 **. tinygui.exe              GUI version, using MessageBox and ExitProcess with contiguous code !W8

 **. tiny.exe                 a universal tiny PE, working from XP to W8 64b
 **. tinyW7.exe               a tiny PE, W7 32b compatible. just need a full optional header, so padding until 252 bytes is required.
 **. tinyW7_3264.exe          a 32b tiny PE, W7 64b compatible (requires a bigger padding, 268 bytes) !W8
 **. tinyW7x64.exe            a 64b tiny PE, in 268 bytes !W8

 *** weirdsord.exe            a PE where 4K is read from the section for no apparent reason

 **. winver.exe               a PE using Win32VersionValue to override OS version numbers

 *.. no_dep.exe               a PE executing code on the stack successfully
 *.. dep.exe                  a PE executing code on the stack, and failing because of DEP
 *.. no_seh.exe               a PE with DllCharacteristics set to NO_SEH, but using a Vectored Exception Handler

 *.. memshared.dll            a DLL with a MEM_SHARED section
      memshared-ld.exe         loader, waiting for X launches to terminate

DataDirectory 0: Export
 **. ownexports.exe           calling its own exports
 **. ownexportsdot.exe        calling its own exports, but with a trailing characters in the import name (may generate crashes)
 **. ownexports2.exe          calling its own virtual and header exports
 **. exportobf.exe            PE with fake exports to disrupt disassembly
 **. exports_doc.exe          PE with exports as internal documentation
 **. exports_order.exe        a PE with exports not alphabetically sorted
 *** exportsdata.exe          PE with its own exports, used to store data, restored on imports resolving

 **. dllord.dll               DLL with exports by ordinal and heavily export corrupted structure
     dllord-ld.exe             loader

 **. dllweirdexp.dll          DLL with weird export (very long, fake, obfuscation (anti-Hiew))
     dllweirdexp-ld.exe        loader

DataDirectory 1: Import
 *.. imports.exe              standard imports
 *.. impbyord.exe             PE importing by ordinal (his own exports)
 *.. imports_apimsW7.exe      imports with Windows 7 redirection via apisetschema.dll
 *.. imports_mixed.exe        mixed case imports
 *.. imports_noext.exe        imports with dll without file extensions (>2K)
 *.. imports_multidesc.exe    a PE with multiple import descriptors for the same DLL
 *.. imports_noint.exe        imports with no INT
 **. imports_badterm.exe      PE with a 'bad' imports terminator, just the dll name is empty
 **. imports_bogusIAT.exe     bogus IAT content but INT is correct
 **. imports_corruptedIAT.exe IAT with corrupted pointers but INT is correct
 **. imports_nnIAT.exe        IAT is not null-terminated but INT is correct
 **. importsdotXP.exe         a PE using trailing characters in its imports (XP/W8 only)
 **. imports_nothunk.exe      imports with a bogus DLL with missing thunks in the tables
 *** imports_relocW7.exe      PE with a kernel range IMAGEBASE, and relocations to fix (manually pre-corrupted) imports
 *** hard_imports.exe         a PE that calls imports by comparing kernel32 timestamp with known list
      dump_imports.exe         tool to extract data for hard_imports

 **. imports_iatindesc.exe    imports with IAT inside descriptors (smallest 'standard' imports structure)
 **. imports_tinyW7.exe       imports with all tricks to make it as small as possible !W8
 **. imports_tinyXP.exe        XP version

 **. imports_virtdesc.exe     PE with 1st import descriptor starting in virtual space
 **. imports_vterm.exe        import terminator in virtual space
 **. importshint.exe          exports with the same name - and the right one is called via hints

DataDirectory 2: Resource
 *.. resource.exe             resources loaded by IDs as integers
 *.. resource2.exe            resource loaded by its IDs as strings
 *.. namedresource.exe        resource, loaded by name
 **. reshdr.exe               resource in the header, and shuffled resource structure
 **. resourceloop.exe         recursive resource directory

 Resource type: RT_STRING
 *.. resource_string.exe      string resource

 Resource type: RT_ICON and RT_GROUP_ICON
 *.. resource_icon.exe        icon resource and group

 Resource type: RT_VERSION
 *.. version_std.exe          'standard' version information (with duplicate entries)
 **. version_cust.exe         a PE with version customized minimal info - only to make the version tab appear
 **. version_mini.exe         a PE with version minimal info

 Resource type: RT_MANIFEST
 *.. manifest.exe             a PE with a minimal MANIFEST resource (CreateActCtx successfull)
 **. manifest_broken.exe      a PE with a checked broken MANIFEST resource (ignored)
 **. manifest_bsod.exe        a PE with a checked MANIFEST resource, that triggers a crash on execution (kb 921337)

DataDirectory 3: Exception
 *.. exceptions.exe           a 64b PE using SEH via its exceptions DD
 **. seh_change64.exe         a 64b PE updating its exceptions DD on the fly

DataDirectory 5: Relocations
 **. fakerelocs.exe           a PE with unused corrupted relocations
 *** virtrelocXP.exe          fake virtual relocations
 **. ibnullXP.exe             null IMAGEBASE (XP only) + relocations
 **. ibkernel.exe             kernel range IMAGEBASE + relocations
 **. ibknoreloc64.exe         a PE32+ with kernel imagebase and RIP-relative code (no relocations)
 *** ibkmanual.exe            kernel range IMAGEBASE, but no relocations, only manually-fixed in advance offsets

 **. reloc4.exe               a PE using relocation type 4 (parameter ignored from W2k to W7, used in W8)
 **. reloc9.exe               a PE using relocation type 9 (different results under XP and W7, unsupported under W8)
 *** reloccrypt.exe           a PE storing its code via relocations patch, with extra fake or rarely used relocations
 *** reloccryptXP.exe          XP version
 *** reloccryptW8.exe          W8 version

 *** ibreloc.exe              relocation is applied to ImageBase in memory, which corrects the wrong entrypoint
 *** ibrelocW7.exe            >XP version !W8

 *** lfanew_relocW7.exe       relocation is applied to e_lfanew in memory => another PE header is then pointed to, which contains the actual imports in the 2nd part of DataDirectories !W8
 *** lfanew_relocXP.exe       XP version

 **. relocsstripped.exe       a PE using relocations even if RELOCS_STRIPPED is set
 **. relocsstripped64.exe     PE32+ version

 *** relocOSdet.exe           combining relocations type 9 and 4 to detect OSes

DataDirectory 6: Debug
 *.. debug.exe                a PE with a Debug Directory (and missing symbols)

DataDirectory 7: Architecture/Copyright
 *.. copyright.exe            a PE with an Architecture DataDirectory entry used for Copyright/Description

DataDirectory 9: Thread local storage
 *.. tls.exe                  standard Thread Local Storage callbacks
 *.. tls64.exe                standard Thread Local Storage callbacks in 64 bits
 **. tls_noEP.exe             TLS PE with ExitProcess call, and no entrypoint at all
 **. tls_exiting.exe          TLS PE with ExitProcess call, and ignored EntryPoint code, even though the TLS is called again after...
 **. tls_import.exe           TLS using an import IAT entry as callbacks => API called with IMAGEBASE as param => WinExec can thus execute MZ.exe
      mz.exe                   executed by tls_import
 **. tls_k32.exe              TLS but only imports to k32 (TLS ignored)
 **. tls_obfuscation.exe      file with extra fake TLS to disturb disassembly (first callbacks triggers an exception)
 **. tls_onthefly.exe         PE with TLS updating on-the-fly the callback list
 **. tls_reloc.exe            Kernel ImageBase + TLS that needs relocation
 **. tls_virtEP.exe           random EntryPoint, and the TLS just allocates virtual space before it's called
 **. tls_aoi.exe              TLS AddressOfIndex is used to patch a dword to 0
 *** tls_aoiOSDET.exe         AddressOfIndex is used to patch turn an import descriptor to a terminator => the OS' different behaviors will alterate imports loading
 *** manyimportsW7.exe        file with too many fake imports, which are 'ignored' on loading by TLS AddressOfIndex

DataDirectory A: Load config
 *.. safeseh.exe              a PE making use of SafeSEH (succeeding or not)
 **. safeseh_fly.exe          a PE modifying its HandlerTable on the fly before triggering an exception

 *.. ldrsnaps.exe             a PE enabling LoaderSnaps via its LoadConfig DataDirectory
 *.. ldrsnaps64.exe            64b version

 *.. ss63.exe                 a PE with a Subsystem 6.3 (which enforces a LoadConfig directory and a valid cookie)
 *.. ss63nocookie.exe         the same but with no cookie and GuardFlags set to IMAGE_GUARD_SECURITY_COOKIE_UNUSED


DataDirectory B: Bound imports
 *.. dllbound-ld.exe          dll loader with bound imports
 **. dllbound-redirld.exe     dll loader with corrupted bound imports to call unexpected API
 **. dllbound-redirldXP.exe   dll loader with corrupted bound imports to call an unexpected API from another DLL
      dllbound.dll             DLL with 2 exports (one normal one 'fake') to test imports binding
      dllbound2.dll            extra DLL to test corruption at dll level (different name, different timestamp)

DataDirectory D: Delay imports
 *.. delayimports.exe         PE with delay imports
 **. delaycorrupt.exe         PE with corrupted delay imports, all set to zero
 **. delayfake.exe            fake delay imports data obfuscation

DataDirectory E: COM Descriptor
 *.. dotnet20.exe             a 'compiled', dissected and manually rebuild, .Net 2.0 PE
 **. tinynet.exe              a tiny .Net PE - with only NumberOfRvaAndSizes=2, 4 streams...
 **. fakenet.exe              a PE with fake .NET EntryPoint, imports but no COM directory
 **. mscoree.exe              a non-managed PE with MSCOREE imports

DataFile DLLs (loaded via LoadLibraryEx with LOAD_LIBRARY_AS_DATAFILE parameter, not resolving imports or executing DLLMain)
 *** d_tiny.dll               a minimal DataFile DLL :only contains MZ, PE and 1 byte of e_lfanew
      d_tiny-ld.exe             loader
 *** d_nonnull.dll            a DataFile DLL containing no null byte
      d_nonnull-ld.exe          loader
 *** d_resource.dll           a DataFile DLL with working resources (most values set to FF while resources are usable)
      d_resource-ld.exe           loader

Special
 **. maxvals.exe              a PE with a maximal values in the headers
 **. standard.exe             a PE with a bit of everything, useful as a all-in-one tutorial PE 'crackme'.

 **. dosZMXP.exe              a non-PE EXE with ZM signature
 *** exe2pe.exe               a non-PE EXE whose DOS stubs patches itself back to PE and relaunch as PE
 *** hdrcode.exe              a PE which header is completely executed (to calculate a fibonacci number via FPU) - NO jump over header data !W8

 *** quine.exe                a working PE file, made entirely in assembly, with no need of a compiler, with its own source embedded, which it displays on execution, via 'typing' its own binary.

 **. fakeregs.exe             corrupting registers as much as possible, during TLS and EP
 **. fakeregslib.dll          loaded DLL corrupting registers as much as possible, during TLS and DllMain

 **. pdf.exe                  a tiny PE with a PDF, copying itself and launching itself under acrobat
 **. pdf_zip_pe.exe           see CorkaMiX

 *.. hdrdata.exe              a PE with data between header and first section

 **. sc.exe                    simple shellcode target

in progress:
     debug.exe                debug data directory
     no_dd64                  self-loading imports in 64 bits