Lost in the Loader - The Many Faces of the Windows PE File Format

This briefing presents research on parser differentials in the Windows PE format. It models Windows loaders and reverse-engineering tools with a custom constraint language to validate files, generate differential test cases, and identify corner cases and malware-relevant discrepancies.

Syllabus

Intro
The PE File Format
PE Headers
Section Table
The Subtle Problem of the PE Ecosystem
Implications of PE discrepancies
The Big Picture
Constraints Modelling
Modelling Phase
Language for Modelling Constraints
INPUT statements
Symbol Definition
(Terminal) Predicates
Conditional Statements
Analysis Framework
Validation Mode
Generation Mode
Model SMT Equivalence
Differential Test Case Generation
Differences Enumeration
Corner Case Generation
Modelled Software
Windows vs Windows
Windows vs. ClamAV
Memory Mapping Discrepancies
Notable Test Case
Malware Hunt Campaign Results
Takeaways