|
Attempt to use a blank (nulls just test sample) 64-byte stub:
4D5A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000
Attach it via format pe64 on 'stub.bin':
4D5A4000010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000040000000
FASM treats it as a legacy MZ executable (e_lfarlc < 0x40) and overwrites e_cblp, e_cp, e_cparhdr, and e_lfarlc.
How to attach a raw stub as-is without FASM modifying these fields?
Also tested with 0xFF fill:
4D5AFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF40000000
• FASM 1: error: value out of range. (or out of memory)
• FASM 2: (heavy lag) Error: error reading file 'stub.bin'.
In FASM 2 (pe.inc), e_cp = 0xFFFF calculates .TEMPLATE_LENGTH ≈ 32MB, and it tries to read 32MB from a 64-byte file. Can this file size check
be added or bypassed?
Last edited by vityacv on 16 Oct 2026, 13:58; edited 2 times in total
|