Project 7: PE Header Parser

Technical Objective

Parses the structural headers of a Windows PE (.exe/.dll) file — DOS header, COFF header, section table, and Import Address Table — directly from raw bytes on disk, with no dependency on the Windows API.

Business Impact Summary: Malware is frequently identifiable by which external libraries and functions it imports, long before any code runs. This tool lets an analyst inspect an unknown binary's capabilities offline and non-destructively, avoiding the risk of detonating a payload during initial triage.

The "Why": Engineering Value & Threat Impact

• Operational Risk / Threat Model: A binary's Import Address Table is one of the first things a reverse engineer checks — imports like WinExec or InternetOpenA flag intent before a single instruction executes.
• Engineering Mastery: Proves the ability to implement a binary file format directly from its specification: manual struct layout, pointer arithmetic, and RVA-to-file-offset translation, with no parsing libraries involved.
• Defensive Utility: Gives malware analysis or detection engineering teams a lightweight, dependency-free triage tool that can be scripted into a pipeline ahead of sandboxing or full disassembly.

Architecture & System Boundary

• Language & Toolchain: C (C11) / GCC (-Wall -Wextra)
• Operating System Focus: Windows PE32 / PE32+ image format, parsed natively on Linux — no <windows.h>, no cross-compilation required
• Core APIs/Primitives Used: Standard C library file I/O only (fopen/fread); every header field is read via manually-defined #pragma pack structs cast onto the in-memory file buffer

Technical Execution (What & How)

• RVA-to-file-offset resolution: Virtual addresses referenced in the optional header and import table are resolved to file offsets by walking the section table and matching the RVA against each section's virtual address range; every lookup is bounds-checked against the buffer so malformed input can't cause an out-of-bounds read.
• PE32 vs. PE32+ divergence: The optional header's magic number (0x10b vs 0x20b) determines image bitness, which shifts the Data Directory array's offset (96 vs. 112 bytes) — handled as a single branch rather than duplicating the whole header layout.
• Import Table reconstruction: Walks each IMAGE_IMPORT_DESCRIPTOR and its Import Lookup Table thunks, distinguishing name-based imports from by-ordinal imports via the thunk's top bit, to reconstruct the full DLL → function import list.

How to Build & Run Locally

make
./pe_parser <path-to-pe-file>