TABPE

What is TABPE?

TABPE (a combination of TABriz + PE - Tabriz is my hometown, and I named this project after my love for my city) is an open, structured dataset containing information about all PE files (Windows executables) including .exe, .dll, .sys, etc., on clean, fully updated versions of Windows 10 Pro and Windows 11 Pro.

My workflow is as follows:

I installed Windows and, each month after Microsoft releases its security updates (Patch Tuesday), I tried to update the system.
In some months, the update was applied exactly on the same day or a few days after Patch Tuesday.
In other months, due to various reasons (such as internet outages in Iran), I couldn't update on time. In those cases, I manually downloaded and installed the update files (.msu).
As a result, the exact scan time relative to Patch Tuesday may vary from a few days to a few weeks. However, in the end, all updates released by Microsoft up to the scan date were applied to the system.

The exact start and end time of each scan is recorded in the pe_files_info.json file under the scan_info section.

Project Outputs

Each Release provides three main files:

File	Description
`pe_files_info.json`	The main file containing complete information about all PE files (headers, sections, imports, exports, SHA256 hash, security info, LOAD_CONFIG, etc.)
`file_list.txt`	Complete list of paths to all PE files in that specific Windows version
`scanner.log`	Log of errors and files the scanner could not access (Access Denied) + error

Sample structure of `pe_files_info.json`

{
    "scan_info": {
        "start_time": "2026-06-04T06:21:51-07:00",
        "end_time": "2026-06-04T08:09:37-07:00",
        "duration": "1h 47m 45s",
        "windows_version": {
            "os_name": "Windows 11 Pro",
            "os_version": "10.0.26100.8457 Build 26100",
            "system_type": "x64-based PC",
            "version": "24H2",
            "last_update": "KB5087054"
        },
        "total_files": 29377,
        "error_files": 12,
        "error_files_list": [
            {
                "id": 7618,
                "path": "C:\\Windows\\SysWOW64\\compobj.dll"
            },
            {
                "id": 8561,
                "path": "C:\\Windows\\SysWOW64\\ole2disp.dll"
            },
            {
                "id": 8562,
                "path": "C:\\Windows\\SysWOW64\\ole2nls.dll"
            },
            {
                "id": 8560,
                "path": "C:\\Windows\\SysWOW64\\ole2.dll"
            },
            {
                "id": 8839,
                "path": "C:\\Windows\\SysWOW64\\storage.dll"
            },
            {
                "id": 8912,
                "path": "C:\\Windows\\SysWOW64\\typelib.dll"
            },
            {
                "id": 28768,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\ole2.dll"
            },
            {
                "id": 28767,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\compobj.dll"
            },
            {
                "id": 28769,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\ole2disp.dll"
            },
            {
                "id": 28770,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\ole2nls.dll"
            },
            {
                "id": 28772,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\typelib.dll"
            },
            {
                "id": 28771,
                "path": "C:\\Windows\\WinSxS\\x86_microsoft-windows-n..nd-syswow64-payload_31bf3856ad364e35_1.0.26100.1_none_d3b8ff829e6c9bfb\\storage.dll"
            }
        ]
    },
    "pe_files": [
        {
            "id": 1,
            "filename": "msdaosp.dll",
            "path": "C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll",
            "sha256": "38390b62e81fd3381d6ea2d50c5e35ff93370e70122326c0cb8de53f9f9085d0",
            "file_type": "dll",
            "has_rich_header": "YES",
            "machine": "AMD64",
            "time_date_stamp": "2010-06-03 08:46:58 UTC",
            "characteristics": [
                "EXECUTABLE_IMAGE",
                "LARGE_ADDRESS_AWARE",
                "UP_SYSTEM_ONLY"
            ],
            "magic": "PE32+",
            "major_linker_version": 14,
            "minor_linker_version": 38,
            "major_os_version": 10,
            "minor_os_version": 0,
            "major_image_version": 10,
            "minor_image_version": 0,
            "major_subsystem_version": 10,
            "minor_subsystem_version": 0,
            "checksum": 188850,
            "subsystem": "WINDOWS_GUI",
            "dll_characteristics": [
                "DYNAMIC_BASE",
                "GUARD_CF",
                "HIGH_ENTROPY_VA",
                "NX_COMPAT"
            ],
            "data_directories": [
                "EXPORT_TABLE",
                "IMPORT_TABLE",
                "RESOURCE_TABLE",
                "EXCEPTION_TABLE",
                "BASE_RELOCATION_TABLE",
                "DEBUG",
                "LOAD_CONFIG_TABLE",
                "IAT"
            ],
            "sections": [
                {
                    "name": ".text",
                    "characteristics": [
                        "CNT_CODE",
                        "MEM_EXECUTE",
                        "MEM_SHARED"
                    ]
                },
                {
                    "name": "fothk",
                    "characteristics": [
                        "CNT_CODE",
                        "MEM_EXECUTE",
                        "MEM_SHARED"
                    ]
                },
                {
                    "name": ".rdata",
                    "characteristics": [
                        "CNT_INITIALIZED_DATA",
                        "MEM_EXECUTE"
                    ]
                },
                {
                    "name": ".data",
                    "characteristics": [
                        "CNT_INITIALIZED_DATA",
                        "MEM_EXECUTE",
                        "MEM_READ"
                    ]
                },
                {
                    "name": ".pdata",
                    "characteristics": [
                        "CNT_INITIALIZED_DATA",
                        "MEM_EXECUTE"
                    ]
                },
                {
                    "name": ".rsrc",
                    "characteristics": [
                        "CNT_INITIALIZED_DATA",
                        "MEM_EXECUTE"
                    ]
                },
                {
                    "name": ".reloc",
                    "characteristics": [
                        "CNT_INITIALIZED_DATA",
                        "LNK_NRELOC_OVFL",
                        "MEM_EXECUTE"
                    ]
                }
            ],
            "exports": [
                "DllCanUnloadNow",
                "DllGetClassObject",
                "DllMain",
                "DllRegisterServer",
                "DllUnregisterServer"
            ],
            "imports": [
                {
                    "dll_name": "ADVAPI32.DLL",
                    "functions": [
                        "RegCloseKey",
                        "RegOpenKeyExW",
                        "RegQueryValueExW"
                    ]
                },
                {
                    "dll_name": "KERNEL32.DLL",
                    "functions": [
                        "CompareStringA",
                        "CompareStringW",
                        "DeleteCriticalSection",
                        "DisableThreadLibraryCalls",
                        "EnterCriticalSection",
                        "GetCurrentProcess",
                        "GetCurrentProcessId",
                        "GetCurrentThread",
                        "GetCurrentThreadId",
                        "GetProcessHeap",
                        "GetSystemDefaultLCID",
                        "GetSystemInfo",
                        "GetSystemTimeAsFileTime",
                        "GetTickCount",
                        "InitializeCriticalSection",
                        "LeaveCriticalSection",
                        "MultiByteToWideChar",
                        "QueryPerformanceCounter",
                        "RtlCaptureContext",
                        "RtlLookupFunctionEntry",
                        "RtlVirtualUnwind",
                        "SetUnhandledExceptionFilter",
                        "Sleep",
                        "TerminateProcess",
                        "TryEnterCriticalSection",
                        "UnhandledExceptionFilter",
                        "WideCharToMultiByte"
                    ]
                },
                {
                    "dll_name": "MSVCRT.DLL",
                    "functions": [
                        "_XcptFilter",
                        "__C_specific_handler",
                        "_amsg_exit",
                        "_callnewh",
                        "_initterm",
                        "_mbsinc",
                        "_purecall",
                        "_wcsicmp",
                        "floor",
                        "free",
                        "malloc",
                        "memcmp",
                        "memcpy",
                        "memmove",
                        "memset",
                        "realloc"
                    ]
                },
                {
                    "dll_name": "OLE32.DLL",
                    "functions": [
                        "CLSIDFromProgID",
                        "CoCreateInstance",
                        "CoGetMalloc",
                        "CoTaskMemFree",
                        "ProgIDFromCLSID",
                        "StringFromCLSID"
                    ]
                },
                {
                    "dll_name": "USER32.DLL",
                    "functions": [
                        "DispatchMessageW",
                        "LoadStringW",
                        "MsgWaitForMultipleObjects",
                        "PeekMessageW",
                        "TranslateMessage"
                    ]
                }
            ],
            "debug_info": [
                "CODEVIEW"
            ],
            "mitigations": [
                "DYNAMIC_BASE/ASLR",
                "NX_COMPAT/DEP",
                "CFG",
                "HIGH_ENTROPY_VA"
            ],
            "has_certificate": false,
            "load_config": {
                "raw": "00000148 size\n0 time date stamp\n0.00 Version\n0 GlobalFlags Clear\n0 GlobalFlags Set\n0 Critical Section Default Timeout\n0 Decommit Free Block Threshold\n0 Decommit Total Free Threshold\n0000000000000000 Lock Prefix Table\n0 Maximum Allocation Size\n0 Virtual Memory Threshold\n0 Process Affinity Mask\n0 Process Heap Flags\n0 CSD Version\n0000 Dependent Load Flag\n0000000000000000 Edit List\n00000001800190C0 Security Cookie\n0000000180015B38 Guard CF address of check-function pointer\n0000000180015B40 Guard CF address of dispatch-function pointer\n0000000180015BD4 Guard CF function table\nA5 Guard CF function count\n10417500 Guard Flags\nCF instrumented\nFID table present\nProtect delayload IAT\nDelayload IAT in its own section\nExport suppression info present\nLong jump target table present\nEH Continuation table present\n0000 Code Integrity Flags\n0000 Code Integrity Catalog\n00000000 Code Integrity Catalog Offset\n00000000 Code Integrity Reserved\n0000000000000000 Guard CF address taken IAT entry table\n0 Guard CF address taken IAT entry count\n0000000000000000 Guard CF long jump target table\n0 Guard CF long jump target count\n0000000000000000 Dynamic value relocation table\n0000000000000000 Hybrid metadata pointer\n0000000000000000 Guard RF address of failure-function\n0000000000000000 Guard RF address of failure-function pointer\n00000228 Dynamic value relocation table offset\n0007 Dynamic value relocation table section\n0000 Reserved2\n0000000000000000 Guard RF address of stack pointer verification function pointer\n00000000 Hot patching table offset\n0000 Reserved3\n0000000000000000 Enclave configuration pointer\n0000000000000000 Volatile metadata pointer\n0000000180015B90 Guard EH continuation table\nD Guard EH continuation count\n0000000180015B48 Guard XFG address of check-function pointer\n0000000180015B50 Guard XFG address of dispatch-function pointer\n0000000180015B58 Guard XFG address of dispatch-table-function pointer\n0000000180015B60 CastGuard OS determined failure mode\n0000000000000000 Guard memcpy function pointer\nGuard CF Function Table\nAddress\n--------\n0000000180001060\n00000001800012E0\n0000000180001550\n00000001800017D0\n0000000180001AA0\n0000000180001AC0\n0000000180001AE0\n0000000180001B60\n0000000180001BA0\n0000000180001CF0\n0000000180001D10\n0000000180001D30\n0000000180001D40\n0000000180001D50\n0000000180001D60\n0000000180001D70\n0000000180002080\n00000001800022C0\n00000001800022D0\n00000001800022F0\n0000000180002B70\n0000000180003470\n00000001800034D0\n0000000180003D20\n0000000180003D30\n0000000180003D40\n0000000180003F30\n0000000180003F50\n0000000180003F60\n0000000180003F70\n0000000180003F80\n0000000180003F90\n0000000180003FA0\n0000000180003FC0\n0000000180003FD0\n0000000180003FE0\n0000000180003FF0\n0000000180004000\n0000000180004010\n0000000180004500\n00000001800046A0\n0000000180004800\n0000000180004810\n0000000180004840\n0000000180004A30\n0000000180005490\n00000001800054A0\n00000001800055A0\n0000000180005710\n00000001800057A0\n00000001800057B0\n00000001800059B0\n0000000180005AD0\n0000000180005B70\n0000000180005BB0\n0000000180005BD0\n0000000180005C10\n0000000180005E00\n00000001800062F0\n00000001800064C0\n0000000180006890\n00000001800068D0\n0000000180006A00\n0000000180006BB0\n0000000180006C30\n0000000180006C50\n0000000180007150\n00000001800075B0\n00000001800076A0\n0000000180007C60\nE 0000000180008570\nE 00000001800085E0\nE 00000001800088F0\n0000000180008BD0\n00000001800094F0\n0000000180009B80\n000000018000A040\n000000018000A060\n000000018000A0A0\n000000018000A3E0\n000000018000A420\n000000018000A620\n000000018000A790\n000000018000A890\n000000018000A8C0\n000000018000A930\n000000018000AA40\n000000018000AA70\n000000018000AAF0\n000000018000AB20\n000000018000AB80\n000000018000AC70\n000000018000ACA0\n000000018000AD30\n000000018000ADB0\n000000018000AE00\n000000018000AF40\n000000018000B470\n000000018000B630\n000000018000BA90\n000000018000CFF0\n000000018000D0D0\n000000018000D190\n000000018000D2E0\n000000018000D2F0\n000000018000D300\n000000018000D310\n000000018000D320\n000000018000D330\n000000018000D350\n000000018000D360\n000000018000D450\n000000018000D4C0\n000000018000D910\n000000018000D930\n000000018000E030\n000000018000E5B0\n000000018000EBF0\n000000018000EC00\n000000018000EF90\n000000018000F370\n000000018000F6F0\n000000018000F780\n000000018000F7D0\n000000018000F7E0\n000000018000F800\n000000018000F820\n000000018000F830\n000000018000FA80\n000000018000FCA0\n00000001800102A0\n0000000180010440\n00000001800104B0\n00000001800105D0\n0000000180010680\n0000000180010960\n0000000180010970\n0000000180010980\n0000000180010990\n00000001800109A0\n00000001800109B0\n0000000180010A10\n0000000180010A20\n0000000180010A30\n0000000180010A40\n0000000180010A50\n0000000180010A60\n0000000180010B50\n0000000180010B90\n0000000180010C90\n0000000180010D00\n0000000180010E80\n0000000180010FD0\n0000000180011580\n0000000180011750\n0000000180012050\n0000000180013080\n0000000180013100\n0000000180013120\n0000000180013140\n0000000180013170\n0000000180013180\n0000000180013190\n00000001800131C0\n00000001800131E0\nGuard EH Continuation Table\nAddress\n--------\n00000001800013A3\n00000001800013DA\n0000000180001411\n000000018000143E\n0000000180001460\n000000018000148E\n00000001800014C4\n0000000180001508\n0000000180001640\n00000001800085C4\n0000000180008B93\n000000018000D49B\n0000000180010CE8\nDynamic Value Relocation Table (version: 1)\nSymbol VA: 0000000000000007 IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE\nTotal function overrides size: 20 bytes\nBDD data: 20 bytes\nFunction Override (1)\nOriginal RVA: 00013480\nBDD Offset: 0\nRVA array size: 4\nReloc size: C\nRVAs:\n[00000000] 00013480\nBDD (version: 1, 18 bytes):\n[00000000] 0002, 0001, 00000142\n[00000001] 0001, 0001, 00000000\n[00000002] 0000, 0000, 00000000\nFixup RVAs:\n[00000000] = page 00014000 rva 00014011 type 1"
            }
        },

Cybersecurity Use Cases

Defensive (Blue Team)

Masquerading Detection: By comparing hashes of files on your system with those in TABPE, you can detect fake files and malware masquerading as legitimate system files (e.g., a fake svchost.exe).
Forensics Analysis: By searching for a file's hash in TABPE, you can quickly determine whether it belongs to Windows itself or is an external threat.
LOLBin Identification (Living Off the Land Binaries): By examining the capabilities of legitimate Windows files (via imports and exports), you can see which built-in tools attackers might use for malicious code execution.

Offensive (Red Team)

DLL Side-Loading: By examining the import table of legitimate executables, you can determine which DLLs a specific executable loads. This information is crucial for DLL Side-Loading techniques.
Finding Files Without Security Mechanisms: By checking the mitigations section, you can find files lacking ASLR or DEP, making exploit development easier.
LOLBin Identification (Living Off the Land Binaries): For the Red Team, it's critical to know which legitimate Windows files have capabilities like code execution, file downloading, or network communication to use in attacks.

Malware Analysis & Exploit Development

Packer Detection: Packed malware often has unusual sections. TABPE provides a baseline of normal files so you can spot anomalies faster.
Mitigation Checks: Before writing an exploit, you need to know which security mechanisms (ASLR, DEP, CFG, etc.) are active on the target file. TABPE gives you this information.

Tracking Changes Over Time (Binary Diffing)

By comparing PE files between two different releases, you can:

See exactly which files changed during each Patch Tuesday.
Identify silent security patches.
Track file changes to analyze zero-day vulnerabilities.

Technical Information

Feature	Value
Platform	Windows 10 Pro & Windows 11 Pro (x64)
Virtualization Environment	VMware Workstation (isolated VM, no host interference)
Update Frequency	Monthly (after each Patch Tuesday)
Number of PE files per version	Approximately 25,000 – 31,000 files
Output Format	JSON (processable with Python, PowerShell, C#, etc.)
Tagging Format	`YYYY.M` (example: `2026.5` for May 2026)
Compressed File Size	~30 MB (original JSON ~1 GB)

Disclaimer

This project is provided for research and educational purposes only. The data presented is a baseline of legitimate Windows files. Any use of this information for illegal, malicious, or unauthorized activities is solely the responsibility of the user. The author assumes no liability for any misuse of this data.

License

This project is released under the MIT License.

TABPE v2026.8

Categories