What about a self replicating 64bit EXE ?

jochenvnltn wrote:

What about a self replicating 64bit EXE ?

You can, either submit a pull request (late entry will be accepted) or use your tiny PE and wait for BGGP 2024 (begin in June).

I was the winner of PE category (@fliermate) with 1024 bytes.
But my late entry is a 528-byte 32-bit PE, as demonstrated in the second last post in page 1 of this thread. (Or you can click link: https://board.flatassembler.net/topic.php?p=237311#237311 )

With your 309-byte tiny PE, I think you can easily beat mine 528-byte PE (and 1KB PE).

Ill delete my post sorry !

; verify some known rules of loader:

load e_lfanew:4 from $$+3Ch ; Offset to the NT header
assert e_lfanew < ($-$$-4) ; can't be larger than file
load PE_Sig:4 from $$+e_lfanew
assert PE_Sig = 'PE'    

mov eax, [fs:ecx+0x30]    

What is "fs"?

Any tiny PE example using GetProcAddress and then LoadLibraryA to call API, especially when need to call more than one API function and want to get rid of import table.

CS
DS
ES
FS
GS
SS

If you want to use them as registers, then you have to switch to (un)real mode.

a working PE64 with import, size of exe-file is 282 bytes run on Windows 10

Code:

format binary as "exe"
include "win64a.inc"
struc dbs [data]
{
  common
  . db data
  .size = $ - .
}
 
IMAGE_DOS_SIGNATURE        equ 5A4Dh
IMAGE_NT_SIGNATURE        equ 00004550h
PROCESSOR_AMD_X8664        equ 8664h
IMAGE_SCN_CNT_CODE        equ 00000020h
IMAGE_SCN_MEM_WRITE        equ 80000000h
IMAGE_SCN_MEM_READ        equ 40000000h
IMAGE_SCN_CNT_INITIALIZED_DATA    equ 00000040h
IMAGE_SUBSYSTEM_WINDOWS_GUI    equ 2
IMAGE_NT_OPTIONAL_HDR64_MAGIC    equ 20Bh
IMAGE_FILE_RELOCS_STRIPPED    equ 1
IMAGE_FILE_EXECUTABLE_IMAGE    equ 2
IMAGE_BASE            equ 0x400000
align1                equ 4;0x10
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE equ 8000h
use64
org 0
;--------DOS-stub-------------------------------
Signature       dw IMAGE_DOS_SIGNATURE,0
;-------PE--------------------------------------------------
ntHeader        dd IMAGE_NT_SIGNATURE;'PE'
;image_header----
Machine             dw PROCESSOR_AMD_X8664
Count_of_section    dw 1
TimeStump           dd 0
Symbol_table_offset dd 0
Symbol_table_count  dd 0
Size_of_optional_header dw section_table-optional_header
Characteristics     dw IMAGE_FILE_RELOCS_STRIPPED or \
IMAGE_FILE_EXECUTABLE_IMAGE
;-------
optional_header:
Magic_optional_header    dw IMAGE_NT_OPTIONAL_HDR64_MAGIC
Linker_version_major_and_minor dw 9
Size_of_code        dd Import_Table-begin
Size_of_init_data   dd 0x70
Size_of_uninit_data dd 0
entry_point         dd begin
base_of_code        dd ntHeader
;-----------------------------------------------------
image_base          dq IMAGE_BASE
section_alignment   dd align1
file_alignment      dd align1
OS_version_major_minor    dw 5,2
image_version_major_minor dd 0
subsystem_version_major_minor dw 5,2
Win32_version       dd 0
size_of_image       dd end_import
size_of_header      dd begin
checksum            dd 0
subsystem           dw IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL_flag            dw IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
Stack_allocation    dq 0x100000
Stack_commit        dq 0x1000
Heap_allocation     dq 0x100000
Heap_commit         dq 0x1000
loader_flag         dd 0
number_of_dirs      dd (section_table-export_RVA_size)/8
export_RVA_size     dq 0
import_RVA_size     dd _import,0x3C
;------------------------------------------------
section_table       dq ".text"
.virtual_size       dd 0x55
.virtual_address    dd begin
.Physical_size      dd end_import-begin
.Physical_offset    dd begin
.Relocations_and_Linenumbers dq 0
.Relocations_and_Linenumbers_count dd 0
.Attributes         dd IMAGE_SCN_MEM_WRITE or IMAGE_SCN_CNT_CODE or IMAGE_SCN_MEM_READ ;or IMAGE_SCN_CNT_INITIALIZED_DATA
;------------------------------------------------
begin:
    push rbp
    xor ecx,ecx
    mov edx,user32_dll+IMAGE_BASE
    lea r8d,[rdx+12]
    xor r9d,r9d
    call [MessageBox]
    pop rbp
    retn
;------------------------------------------------
Import_Table:
user32_table:
MessageBox  dq _MessageBox,0
_import:
dd 0,0,0,user32_dll,user32_table
dd 0
user32_dll db "user32",0,0
dw 0
_MessageBox        db 0,0,"MessageBoxA"
end_import:    

Hey so I'm coming back to this since I want to use this as a basis for a personal asm project I'm trying to get started with, and I'm wondering if there is any way to automatically calculate some of the hardcoded stuff like the virtual size and the import RVA size? Having to figure out exactly what values they need to be every time I want to make a code change would be annoying. And this is more so related to my complete and utter lack of windows PE knowledge but I'm also not sure how I would extend the import table to add multiple dlls since I also want to use specific functions from opengl32 and kernel32.

therektafire wrote:

Hey so I'm coming back to this since I want to use this as a basis for a personal asm project I'm trying to get started with, and I'm wondering if there is any way to automatically calculate some of the hardcoded stuff like the virtual size and the import RVA size? Having to figure out exactly what values they need to be every time I want to make a code change would be annoying. And this is more so related to my complete and utter lack of windows PE knowledge but I'm also not sure how I would extend the import table to add multiple dlls since I also want to use specific functions from opengl32 and kernel32.

I don't know the exact requirements of your project, but to get accustomed with manual construction of PE please consider my PE tutorial. The templates provided there are flexible, with all the values computed properly.

format PE64 GUI 5.0
entry start

include 'win64a.inc'

section '.text' code readable executable

  start:
        sub     rsp,8           ; Make stack dqword aligned

        invoke  GetModuleHandle,0
        mov     [wc.hInstance],rax
        invoke  LoadIcon,0,IDI_APPLICATION
        mov     [wc.hIcon],rax
        mov     [wc.hIconSm],rax
        invoke  LoadCursor,0,IDC_ARROW
        mov     [wc.hCursor],rax
        invoke  RegisterClassEx,wc
        test    rax,rax
        jz      error

        invoke  CreateWindowEx,0,_class,_title,WS_VISIBLE+WS_DLGFRAME+WS_SYSMENU,128,128,256,192,NULL,NULL,[wc.hInstance],NULL
        test    rax,rax
        jz      error   
        ….