x
This website is using cookies. We use cookies to ensure that we give you the best experience on our website. More info. That's Fine
HPC:Factor Logo 
 
Latest Forum Activity

Find out which architecture an exe was compiled for

Moderators: C:Amie

Jump to page : 1
Now viewing page 1 [15 messages per page]

Karpour Page Icon Posted 2020-11-13 11:49 PM
#
Avatar image of Karpour
Subscribers
H/PC Philosopher

Posts:
269
Location:
Austria
Status:
I'm writing some scripts to sort through loads of old software, lots of them are just loose exe and dll files.

Before I spend too much time reading on file headers, I'll ask here first!

Which bytes in the header of an exe/dll tell me which architecture the file was compiled for (and ideally also which windows ce version)
 Top of the page
stingraze Page Icon Posted 2020-11-14 12:24 AM
#
Avatar image of stingraze
Writing Team
H/PC Vanguard

Posts:
2,506
Location:
Japan
Status:
This might help:

https://www.cabextract.org.uk/wince_cab_format/

snippet from the site:

The .000 file begins at file offset 0 with a fixed size header of exactly 100 bytes. The format of this header is as follows: 
Offset	Size in bytes	Description 
... 
20	4	Target architecture for this cabinet: see Appendix A 
... 
Appendix A:
Appendix A: a list of processor architectures 
Value	Description 
0	No specific architecture 
103	SHx SH3 
104	SHx SH4 
386	Intel 386 
486	Intel 486 
586	Intel Pentium 
601	PowerPC 601 
603	PowerPC 603 
604	PowerPC 604 
620	PowerPC 620 
821	Motorola 821 
1824	ARM 720 
2080	ARM 820 
2336	ARM 920 
2577	StrongARM 
4000	MIPS R4000 
10003	Hitachi SH3 
10004	Hitachi SH3E 
10005	Hitachi SH4 
21064	Alpha 21064 
70001	ARM 7TDMI 


But this is for cabinet file though. Maybe there's info on .exe and dll. I will report back if I find it.

A bit tangent, but may come in handy:

Embedded Reverse Engineering: Cracking Mobile Binaries
https://media.defcon.org/DEF%20CON%2011/DEF%20CON%2011%20presentatio...

-stingraze

Edited by stingraze 2020-11-14 12:53 AM
 Top of the page
hpcboy Page Icon Posted 2020-11-14 2:29 AM
#
Avatar image of hpcboy
Subscribers
H/PC Philosopher

Posts:
256
Location:
Hong Kong SAR
Status:
This comes very handy. Thanks for the pointer!
 Top of the page
CE Geek Page Icon Posted 2020-11-14 3:00 AM
#
Avatar image of CE Geek
Global Moderator
H/PC Oracle

Posts:
12,210
Location:
Southern California
Status:
Sounds very familiar, stingraze:

https://www.hpcfactor.com/support/cesd/d/0004.asp



If you're looking at the file in a hexeditor, search for the first instance of the sequence 50 45 00 00. Right after that is the CPU identifier:

4C 01 = x86 (also applies to .NET Compact Framework-based apps)
66 01 = MIPS
A2 01 = SH3
A6 01 = SH4
C0 01 = ARM
C2 01 = thumb

The CE version is 72 bytes past the 50 byte above:

02 00 00 = Windows CE 2.0
02 00 01 = CE 2.01 (Palm-size PC)
02 00 0A = CE 2.10
02 00 0B = CE 2.11
02 00 0C = CE 2.12
03 00 00 = CE 3.0
04 00 00 = CE.net 4.0
04 00 0A = CE.net 4.1
04 00 14 = CE.net 4.2
04 00 15 = CE.net 4.21 (Windows Mobile 2003 SE)
 Top of the page
stingraze Page Icon Posted 2020-11-14 4:38 AM
#
Avatar image of stingraze
Writing Team
H/PC Vanguard

Posts:
2,506
Location:
Japan
Status:
hpcboy: You're welcome!

Thanks CE Geek.
Always more things to learn.

Edited by stingraze 2020-11-14 4:39 AM
 Top of the page
Karpour Page Icon Posted 2020-11-14 7:20 PM
#
Avatar image of Karpour
Subscribers
H/PC Philosopher

Posts:
269
Location:
Austria
Status:
That's very helpful, thanks CE Geek!

Also thanks stingraze, I already knew this site! I think I'll also make a tool to automatically process the headers of the 000 file inside a cab file, so I can automatically sort cabs and executables by architecture and minimum CE version!
I literally have hundreds of loose exe and cab files with not-too-helpful names, so anything that helps with sorting is good

I just spent 2 hours going through a whole cache of CE1.0 applications, testing if they actually work on me HP320lx and taking screenshots of every app!
 Top of the page
Karpour Page Icon Posted 2020-11-15 9:45 PM
#
Avatar image of Karpour
Subscribers
H/PC Philosopher

Posts:
269
Location:
Austria
Status:
PS > gcc -o wce.exe .\wcepeinfo.c; .\wce.exe .\nqce.exe  
Processing file .\nqce.exe 
Machine: 0x01A2 
Machine name: SH3 
Timestamp: 946208555 
Timestamp: 1999-12-26 


Making progress!
As it turns out, the PE header also contains a timestamp from then the program was compiled! That'll help dating obscure CE apps!

Unlike my previous app for converting 2bp files, which turned out to be a 40mb binary using node-pkg, I'm doing that I should've done long ago and learn proper C
I did a lot of embedded dev in C/C++, but on PC all my experience is higher level languages, so while I do speak C, I have a little catching up to do to write proper cli tools!
 Top of the page
hpc:factor« View previous thread · Developers Arena · View next thread »

Jump to page : 1
Now viewing page 1 [15 messages per page]

Jump to forum:
Seconds to generate: 0.046 - Cached queries : 63 - Executed queries : 8
Server Time now is: Wednesday, 2 December 2020 - 16:8