Smallest Win32 PE..

Index > Windows > Smallest Win32 PE..

Goto page Previous 1, 2

Author

Thread

RedGhost

Joined: 18 May 2005
Posts: 443
Location: BC, Canada

RedGhost 23 Oct 2005, 00:29

Ancient One wrote:

RedGhost.. the dos header is a fixed sized structure.. exactly 0x40 bytes.. i put the Win32 code inside the dos header, between the first field ('MZ' signature) and the last field (offset to nt header).. so, we only have 0x40-2-4 bytes to work on.

Rev, i lost the code and i don't have win98 installed so i cannot put it here.. but i will try to recreate it later.

ah, ok thanks for clarifying

_________________
redghost.ca

23 Oct 2005, 00:29

SDragon

Joined: 13 Sep 2005
Posts: 19
Location: Siberia

SDragon 24 Oct 2005, 10:07

Some guy called server2000 had published 153 bytes exe with no hardcoded addresses. Here is his article in Russian:

http://www.xakep.ru/post/21399/default.asp

Some fields in headers are overlayed, "MZ..PE" used as message. IMHO, this should be interesting for you.

Description:	153 bytes exe	Download
Filename:	mzpe153.zip
Filesize:	240 Bytes
Downloaded:	584 Time(s)

24 Oct 2005, 10:07

Chewy509

Joined: 19 Jun 2003
Posts: 297
Location: Bris-vegas, Australia

Chewy509 25 Oct 2005, 01:33

polygon7 wrote:

shism2 wrote:
You could probably make it even smaller ...... I think by using some hash routines......
I think you can't - hash proc will be equal in size or greater than exe shown above.

I saw something similar (smallest PE exe) in Assembly Programming Journal (i think it was in vol 2).

This article:Google Cache of vol2 ?

25 Oct 2005, 01:33

Ancient One

Joined: 28 Feb 2005
Posts: 55

Ancient One 25 Oct 2005, 03:43

wow.. thats really cool..can anyone help translate the article to english please???

25 Oct 2005, 03:43

Ancient One

Joined: 28 Feb 2005
Posts: 55

Ancient One 25 Oct 2005, 03:50

i done the overlapping header before but it didn't work so i thought it never will work.. silly me!

25 Oct 2005, 03:50

shism2

Joined: 14 Sep 2005
Posts: 248

shism2 25 Oct 2005, 04:28

ya someone transalate it to english... babelfish does an OK trans but not clear enough

25 Oct 2005, 04:28

polygon7

Joined: 14 Aug 2003
Posts: 62
Location: Poznan, Poland

polygon7 25 Oct 2005, 07:13

Chewy509 wrote:

This article:Google Cache of vol2 ?

Yes, it is. Smile

_________________
best regards
p7

25 Oct 2005, 07:13

Ancient One

Joined: 28 Feb 2005
Posts: 55

Ancient One 26 Oct 2005, 05:55

now here a really small exe based on the 153 bytes program.. (but it still use hardcoded address that run in xp sp-0). it's 98 bytes in size

Code:

use32
image_base equ 0x400000

 dos_header:
dw 'MZ'
dw 0

 nt_header:
dd 'PE'
dw 0x14c, 0
main:
push user32+image_base
call 0x77e805d8-image_base
jmp next1

dw sizeof_optional_header
dw 0x10e

 optional_header:
dw 0x10b
next3:
push eax
call 0x77d6add7-image_base
ret
user32 db 'user32', 0
dd main
next2:
push user32+image_base
jmp next3
rb 1
dd image_base
dd 4, 4
dw 4, 1, 0, 0, 3
next1:
xor eax, eax
push eax eax
jmp next2
dd sizeof_image
dd sizeof_headers
rb 4
dw 2
sizeof_optional_header = $-optional_header
sizeof_headers=sizeof_optional_header
sizeof_image=$

26 Oct 2005, 05:55

estrang

Joined: 02 Nov 2005
Posts: 38

estrang 16 Nov 2005, 13:28

Code:

LoadLibrary equ 0x7c801d77-image_base ;hardcoded address 
MessageBox equ 0x77d804ea-image_base  ;hardcoded address

Where did you guys get these stuffs(addresses)?? Disassemblimg?

16 Nov 2005, 13:28

RedGhost

Joined: 18 May 2005
Posts: 443
Location: BC, Canada

RedGhost 16 Nov 2005, 16:28

estrang wrote:

Code:
LoadLibrary equ 0x7c801d77-image_base ;hardcoded address 
MessageBox equ 0x77d804ea-image_base  ;hardcoded address    
Where did you guys get these stuffs(addresses)?? Disassemblimg?

well you could disassemble or debug, but the easiest way would be to call GetProcAddress then log the address

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/getprocaddress.asp

_________________
redghost.ca

16 Nov 2005, 16:28

chris

Joined: 05 Jan 2006
Posts: 62
Location: China->US->China->?

chris 05 Jan 2006, 05:19

well, let's say it should be called the smallest 'hello world' win32 PE,
what if the program does nothing but ret immediately after it is loaded by windows loader? it would be definitely smaller Smile

05 Jan 2006, 05:19

Ancient One

Joined: 28 Feb 2005
Posts: 55

Ancient One 12 Jan 2006, 05:29

not really chris... the code itself use part of unused header so less code does not make it smaller.

the address can be found easily using any PE dump sort of programs.

12 Jan 2006, 05:29

chris

Joined: 05 Jan 2006
Posts: 62
Location: China->US->China->?

chris 12 Jan 2006, 08:54

okey, I think I got your idea, Ancient One, thanks.

I guest the most tricky part is that the section alignment field
in image_optional_header32 has an offset 60 (after padding 2bytes following 'MZ') which is exactly the offset of e_lfanew in image_dos_header. This makes the two headers "merged" together Smile

For you guys want to run it in WinXP SP2, just change
0x77e805d8 to 0x7c801d77(LoadLibraryA) and
0x77d6add7 to 0x77d804ea(MessageBoxA) both of them
have new addresses in SP2.

12 Jan 2006, 08:54

Goto page Previous 1, 2

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum