Index
> Compiler Internals > Incorrect FASM-EXE format |
| Author |
|
|
revolution 06 Feb 2025, 06:11
What is the file "F:\Test.Exe"?
Perhaps you can post the file (or the source) and someone can solve it. |
|||
06 Feb 2025, 06:11 |
|
|
ProMiNick 06 Feb 2025, 06:29
There is only one program that should accept executables - target operating system.
PE viewers are mostly programs that created by students that not enought competent in software internals, they make assumptions, and build final solutions based on that assumptions not official documentation. If OS loader decide that program is valid and execute it - no matter what think 3rd party PE viewer. |
|||
|
06 Feb 2025, 06:29 |
|
|
Core i7 06 Feb 2025, 07:04
revolution wrote: Perhaps you can post the file (or the source) Here's a simple HelloWorld! Code: format pe64 gui 6.0 include 'win64ax.inc' entry start ;//----------- section '.data' data readable writeable msg db 'Hello World!',0 ;//----------- section '.text' code readable executable start: sub rsp,8 invoke MessageBox,0,msg,0,0 invoke ExitProcess,0 ;//----------- section '.idata' import data readable library kernel32,'kernel32.dll',user32,'user32.dll' include 'api\kernel32.inc' include 'api\user32.inc' ProMiNick wrote: PE viewers are mostly programs that created by students I just mean that such a reaction only occurs with FASM-EXE, while the code of other compilers MASM/NASM/C++/etc is somehow perceived by the PE viewer normally. So the problem is in FASM, and not in the schoolboy who wrote the "Lister" plugin for TotalCmd. In general, this is not important, I just noticed such an error and wanted to ask. |
|||
|
06 Feb 2025, 07:04 |
|
|
revolution 06 Feb 2025, 07:40
The source code above compiles to a valid exe, so I don't see how fasm is creating a problem there.
Are you sure the "Lister" program is seeing the same file? Are you sure the "Lister" program is 100% correct? |
|||
|
06 Feb 2025, 07:40 |
|
|
ProMiNick 06 Feb 2025, 08:07
Core i7 wrote: So the problem is in FASM, and not in the schoolboy who wrote the "Lister" plugin for TotalCmd In the world lives men & women. All of them interact together. Like a valid programs in OS. And thou(some kind of PE Viewer) that couldn`t communicate with men(fasm compiled like ones) and requesting all men become women(other compiled like ones). So our answer: "We initialy what we are. We have no problem, others than thou have no problem too. No one have no problem. Dude it is only thour problem" _________________ I don`t like to refer by "you" to one person. My soul requires acronim "thou" instead. |
|||
|
06 Feb 2025, 08:07 |
|
|
Core i7 06 Feb 2025, 09:04
revolution yes, the code compiles correctly and works fine in the versions of Windows-7/10 available to me. But for some reason it gives an error during static analysis in "Lister", although everything is fine during dynamic analysis in the x64dbg debugger. At the same time, exactly the same "HelloWorld" from MASM and NASM in "Lister" does not cause any problems. I have already compared the fields in the PE file header of the two EXEs, and everything seems to be the same there.
And the interesting story by ProMiNick about men and women does not solve this problem, but only hides it in deep pockets. If the error were in "Lister", then the EXE files from MASM would not open either. As you can see in the picture below, everything is OK here.
|
||||||||||
|
06 Feb 2025, 09:04 |
|
|||||||||
|
Core i7 06 Feb 2025, 09:17
I've just gotten used to pressing F3 or Ctrl+Q from TotalCmd when I need to view fields in the PE-header or import/export at once. But here I've already discovered a mistake. Oh well, I'll somehow live without Lister..
|
|||
|
06 Feb 2025, 09:17 |
|
|
bitRAKE 06 Feb 2025, 09:32
Core i7 wrote: I just mean that such a reaction only occurs with FASM-EXE, while the code of other compilers MASM/NASM/C++/etc is somehow perceived by the PE viewer normally. So the problem is in FASM, and not in the schoolboy who wrote the "Lister" plugin for TotalCmd. In general, this is not important, I just noticed such an error and wanted to ask. Perhaps you could produce a minimal example that would allow you to modify FASM to align with your other tools. It is possible to align FASM with some reduced expression of executable. This thread on binary formats might be helpful. |
|||
|
06 Feb 2025, 09:32 |
|
|
Core i7 06 Feb 2025, 09:48
bitRAKE thanks, good link, I'll definitely check it out
|
|||
|
06 Feb 2025, 09:48 |
|
|
revolution 06 Feb 2025, 10:12
Note that MASM etc. do not produce executable files. They create object files. Then they need the linker to create the exe.
You can also use fasm to make an object file. Then link it. See if that makes "Lister" happy. |
|||
|
06 Feb 2025, 10:12 |
|
|
bitRAKE 06 Feb 2025, 10:28
The author of "Lister" might be grateful to know there are valid executables which are not processed correctly. They are probably already aware of this. Perhaps it is only the knowledge users of their tool desire broader support which would be useful.
|
|||
|
06 Feb 2025, 10:28 |
|
|
Mat Quasar 06 Feb 2025, 19:15
In case most readers here don't understand Russian... I have translated the screenshot posted by OP, using Google Lens.
|
||||||||||
|
06 Feb 2025, 19:15 |
|
|||||||||
|
AsmGuru62 06 Feb 2025, 20:26
Why not ask the author of "Lister" what exactly causes the error message.
Then look into the PE Format which should be described by Microsoft, since they are the engineers of PE files. There must be some kind of discrepancy between the PE Format and the ability of OS (also from Microsoft) to execute the PE. There must be something that Microsoft ignores when executing the PE. Or, it can be a backward compatibility thing: newly generated PE must have something new in them, but that should not prevent old files from running. Maybe "Lister" is exactly follows the format and new stuff should not indicate an error, because OS runs it OK. |
|||
|
06 Feb 2025, 20:26 |
|
|
revolution 06 Feb 2025, 20:33
fasm (with the default macros and things) generates valid PE files. End of story.
The problem is within Lister. That is the place to fix the problem. You can easily coax fasm into generating invalid PE files if you wish to. That didn't happen here. |
|||
|
06 Feb 2025, 20:33 |
|
< Last Thread | Next Thread > |
Forum Rules:
|