is this a compiler thing? or its just me?

Index > Main > is this a compiler thing? or its just me?

Author

Thread

Nameless

Joined: 30 Apr 2010
Posts: 95

Nameless 06 May 2010, 05:14

when i tried to put 'lpResource db 'SETTINGS',0' right before .code section, like this

Code:

lpResource    db      'SETTINGS',0
.code
 Start:

the output is 424+ kb :S

when i put it the same line, in the same app, but anywhere else (at the very top of the .data section for example) the output is the normal size
am i missing something here?
i can show anyone on teamviewer, just drop me a pm

06 May 2010, 05:14

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 06 May 2010, 05:40

Mixing initialised data with uninitialised data.

Code:

.data
rb 1000000 ;uninitialised
db 'X' ;initialised

Code:

.data
db 'X' ;initialised
rb 1000000 ;uninitialised

One section is 1 byte long and the other is 1000001 bytes long. The PE format can store implicit zeros at the end of a section but not at the beginning. You should either put all initialised data into a separate section, or put all initialised data together at the start of a section.

06 May 2010, 05:40

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 06 May 2010, 05:46

revolution wrote:

One section is 1 byte long and the other is 1000001 bytes long.

This can be misleading: both sections are 1000001 bytes long, they differ only in their representation in PE. Wink

06 May 2010, 05:46

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 06 May 2010, 08:29

Yes, baldr is correct. When the exe is loaded into memory the section sizes will be the same. But on disk the stored section sizes differ greatly.

06 May 2010, 08:29

Nameless

Joined: 30 Apr 2010
Posts: 95

Nameless 06 May 2010, 09:38

oh
ok, thanks for the info, also sorry for the mis-understanding

06 May 2010, 09:38

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum