flat assembler
Message board for the users of flat assembler.

Index > Compiler Internals > FASM custom IMAGE_DOS_HEADER bug?

Author
Thread Post new topic Reply to topic
vityacv



Joined: 27 Oct 2012
Posts: 23
vityacv 16 Oct 2026, 13:50
Attempt to use a blank (nulls just test sample) 64-byte stub:

4D5A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000

Attach it via format pe64 on 'stub.bin':

4D5A4000010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000040000000

FASM treats it as a legacy MZ executable (e_lfarlc < 0x40) and overwrites e_cblp, e_cp, e_cparhdr, and e_lfarlc.
How to attach a raw stub as-is without FASM modifying these fields?

Also tested with 0xFF fill:

4D5AFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF40000000

• FASM 1: error: value out of range. (or out of memory)
• FASM 2: (heavy lag) Error: error reading file 'stub.bin'.

In FASM 2 (pe.inc), e_cp = 0xFFFF calculates .TEMPLATE_LENGTH ≈ 32MB, and it tries to read 32MB from a 64-byte file. Can this file size check
be added or bypassed?


Last edited by vityacv on 16 Oct 2026, 13:58; edited 2 times in total
Post 16 Oct 2026, 13:50
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 21191
Location: In your JS exploiting you and your system
revolution 16 Oct 2026, 13:57
Some fields in the MZ header need to be correct for the loader to find the PE header. So modifying the header is needed for the file to load correctly. Without the changes the file is not valid.

To get a raw header with all zero bytes, manually overwrite the header after fasm creates the binary. The file probably won't run after that because the PE header offset is lost. Try it and see what Windows makes of it.
Post 16 Oct 2026, 13:57
View user's profile Send private message Visit poster's website Reply with quote
vityacv



Joined: 27 Oct 2012
Posts: 23
vityacv 17 Oct 2026, 17:05
The PE offset at 0x3C is already set (40 00 00 00), so it runs fine on Windows.
An attached stub can be bigger than 64 bytes, so manually editing fields afterwards isn't practical. Having FASM attach it as-is would be much better.
Post 17 Oct 2026, 17:05
View user's profile Send private message Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8565
Location: Kraków, Poland
Tomasz Grysztar 17 Oct 2026, 18:10
As noted here, I am aware that current PE loaders do not care about MZ header fields other than the "MZ" signature and the PE offset. But this is not an universal rule and fasm aims to produce files that should be valid for various legacy systems, too.

Therefore I second revolution's suggestion to manually overwrite the header in post-processing. With fasm2 it is very easy:
Code:
format PE64 on 'nul'

postpone ?
        store 0: 3Ch-2 at :2
end postpone

int3    
Post 17 Oct 2026, 18:10
View user's profile Send private message Visit poster's website Reply with quote
vityacv



Joined: 27 Oct 2012
Posts: 23
vityacv 22 Oct 2026, 18:23
Tomasz Grysztar wrote:
But this is not an universal rule and fasm aims to produce files that should be valid for various legacy systems, too.

Yes, but if a user supplies a non-standard custom DOS stub, FASM silently "fixes" it - altering the output without any warning.
For comparison, Microsoft Linker (v14.51) leaves the stub untouched except for e_lfanew (and adding the Rich Header). Even with an almost-blank stub (only e_magic and e_lfanew), it issues a warning and attaches it as-is.
Post 22 Oct 2026, 18:23
View user's profile Send private message Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8565
Location: Kraków, Poland
Tomasz Grysztar 23 Oct 2026, 15:49
I'm not going to produce a malformed MZ header just because makers of other software decided that it's not important anymore. Even if not to others, it is important to me (in part due to fasm's DOS roots).

And with fasm2 you can do anything you want anyway, either by post-processing as demonstrated above, or even by making a customized PE.INC.

With fasm 1 post-processing is an option too, but requires separate stages (like the ones made by Grom PE).
Post 23 Oct 2026, 15:49
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2026, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.