Reverse Engineering Malware 101

Re:Reverse Engineering Malware 101 by mech_eng_lewis on Wednesday March 29, 2017 @05:21PM (#13990680)

Does the PE standard differ for x86 and ARM? Windows runs on ARM now right, but in ARM I believe the stack grows up (to higher memory addresses) and in x86, as most people know, it grows down. Does anyone know if PE accounts for this? Or is it just abstracted away in PE?

[ Parent | on HN ]

Re:Reverse Engineering Malware 101 by smeenai on Wednesday March 29, 2017 @11:25PM (#13992613)

ARM supports the stack growing in either direction, but on Windows ARM it grows down.

PE/COFF does have some architectural differences though; for example, the relocation types differ across architectures.

[ Parent | on HN ]

Re:Reverse Engineering Malware 101 by SCHiM on Wednesday March 29, 2017 @05:57PM (#13990987)

The only fields in the PE header dealing directly with the stack are:

   SizeOfStackReserve:           0x00100000
   SizeOfStackCommit:            0x00001000

Certainly nothing there that indicates which way the stack should grow. PE does not deal with the stack directly.

[ Parent | on HN ]