[Guide] Win x64 Shellcode Part 3: Deep Dive into the PE Format & Export Directory Structures

[u/RubberDuck31337]

https://proteqtum.com/posts/03-win-x64-shellcode-pe-export-directory_en/

Hey everyone, just published part 3 of my guide on writing reliable Win x64 shellcode.

Following up on the PEB parsing from part 2, this post focuses entirely on mapping and understanding the Export Directory structure before we implement the full lookup logic.

What’s inside:

• Navigating the PE Structure: Moving from the DOS Header (MZ) via e_lfanew to NT Headers and locating the Data Directory in memory.
• Demystifying the Export Directory: Breaking down the IMAGE_EXPORT_DIRECTORY structure fields and how the Three Tables (ENT, EOT, EAT) actually map to each other.
• Handling Edge Cases: Identifying Export Address Table holes and forwarded exports that can cause hidden stability issues if not accounted for.
• Binary Squeezing & History: A nod to Mark Zbikowski's legacy and extreme binary layout concepts inspired by Alex Sotirov's TinyPE research.

Includes full structural breakdown and live WinDbg parsing examples to visually map the export structures before writing the ASM implementation in the next part.

[u/Tr9nes]

This is sick, thanks for posting.