Dissecting PE Headers

Walkthrough summary

Dissecting PE Headers TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• What data type are the PE headers?
  Open the walkthrough page to inspect the full answer and command flow.
• How many bytes are present in the IMAGE_DOS_HEADER?
  Open the walkthrough page to inspect the full answer and command flow.
• What does MZ stand for?
  Open the walkthrough page to inspect the full answer and command flow.
• In what variable of the IMAGE_DOS_HEADER is the address of IMAGE_NT_HEADERS saved?
  Open the walkthrough page to inspect the full answer and command flow.
• In the attached VM, open the PE file Desktop/Samples/zmsuz3pinwl in pe-tree. What is the address of IMAGE_NT_HEADERS for this PE file?
  Open the walkthrough page to inspect the full answer and command flow.