flat assembler
Message board for the users of flat assembler.

Index > Windows > Smallest Win32 PE..

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
i manage to create a 158 bytes Win32 application that displays "hello fasm" using user32.dll's MessageBoxA API..i only managed to test on on WinXP Pro Build 2600 with no Service Packs.. and the most interesting about this program is.. we don't need any section!!! Due to the facts that kernel32.dll already loaded, i use hardcoded address of LoadLibraryA to load user32.dll and use hardcoded address of MessageBoxA. The code itself located in unused area of dos header Smile...

this make me ask myself - how does the PE loader really should work??

Code:
;tested on winxp pro build 2600 (no service packs)
use32
image_base equ 0x400000
LoadLibrary equ 0x77e805d8-image_base ;hardcoded address
MessageBox equ 0x77d6add7-image_base  ;hardcoded address

dos_header:
.signature dw 'MZ'

start:
        call @f
        db 'user32',0
        @@:
        call LoadLibrary
        xor eax, eax
        push eax
        call @f
        db 'small',0
        @@:
        call @f
        db 'hello fasm.',0
        @@:
        push eax
        call MessageBox
        ret

sizeof.code = $-start

rb 64-(sizeof.code)-2-4
dd pe_header

pe_header:
.signature dd 'PE'

file_header:
.machine dw 0x14c
.sections dw 0
dd 0, 0, 0
dw sizeof.optional_header
.flags dw 0x10E

optional_header :
.magic dw 0x10B
db 1, 0
dd 0, 0, 0
.entry dd start
dd 0, 0
.base dd image_base
.alignment dd 1, 1
.version dw 4,1,0,0,4,1
dd 0
dd sizeof.image
dd sizeof.headers
dd 0
.subsystem dw 2
;dw 0
;dd 0
;dd 0
;dd 0
;dd 0
;dd 0
;dd 0 ;no. of data dirs

data_dir:

sizeof.optional_header = $-optional_header
sizeof.headers = sizeof.optional_header;$-dos_header
sizeof.image = $

    
Post 17 Oct 2005, 04:19
View user's profile Send private message MSN Messenger Reply with quote
veach1



Joined: 16 Jul 2004
Posts: 165
veach1
Some times ago there was russian MessageBox compo.


Description:
Download
Filename: MessageBox_compo.zip
Filesize: 16.56 KB
Downloaded: 479 Time(s)


_________________
dream of mind creates a monster


Last edited by veach1 on 17 Oct 2005, 10:33; edited 1 time in total
Post 17 Oct 2005, 06:44
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17716
Location: In your JS exploiting you and your system
revolution
I wonder what would happen if you ran that in DOS?
Post 17 Oct 2005, 07:57
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17716
Location: In your JS exploiting you and your system
revolution
If anyone wants to run it on WinXP SP2 use this:
Code:
LoadLibrary equ 0x7c801d77-image_base ;hardcoded address 
MessageBox equ 0x77d804ea-image_base  ;hardcoded address    
Post 17 Oct 2005, 08:03
View user's profile Send private message Visit poster's website Reply with quote
FrozenKnight



Joined: 24 Jun 2005
Posts: 128
FrozenKnight
The reason this works the way you made it is because you told it that the PE start location is the MZ dos start location. since windoes has already set up the 32 bit memory segiment for the PE file the Addresses already in memory. since you've already pre loaded the Addresses windows doesnt have to look them up from the import table.
Post 17 Oct 2005, 10:53
View user's profile Send private message Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
Quote:

I wonder what would happen if you ran that in DOS?

i think it just execute the contents of nt headers.

how about the stack and heap (reserve/commit)?.. the info had been deleted from the above program. the last field of optional header is the subsystem..OllyDbg cannot load this program also.
Post 18 Oct 2005, 03:02
View user's profile Send private message MSN Messenger Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
Ancient One wrote:
how about the stack and heap (reserve/commit)?.. the info had been deleted from the above program. the last field of optional header is the subsystem..OllyDbg cannot load this program also.
You're right, but that's a smallest-working-exe contest, so the only limitation is that it should work Smile And the goal was achieved Razz
Post 18 Oct 2005, 12:19
View user's profile Send private message Visit poster's website Reply with quote
RedGhost



Joined: 18 May 2005
Posts: 443
Location: BC, Canada
RedGhost
hmm, my windows wont let a binary be compiled under 1kb, is there a trick to this??

i have windows XP home sp2, but i noticed the same on sp1

_________________
redghost.ca
Post 18 Oct 2005, 23:22
View user's profile Send private message AIM Address MSN Messenger Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
Rev. yup.. i think this is the smallest working pe executable in the world Very Happy...

RedGhost, u need to build the headers manually by using compiler that can output flat binary like fasm.
Post 19 Oct 2005, 03:00
View user's profile Send private message MSN Messenger Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
You could probably make it even smaller ...... I think by using some hash routines......
Post 19 Oct 2005, 03:54
View user's profile Send private message Reply with quote
polygon7



Joined: 14 Aug 2003
Posts: 62
Location: Poznan, Poland
polygon7
shism2 wrote:
You could probably make it even smaller ...... I think by using some hash routines......
I think you can't - hash proc will be equal in size or greater than exe shown above.

I saw something similar (smallest PE exe) in Assembly Programming Journal (i think it was in vol 2).

_________________
best regards
p7
Post 19 Oct 2005, 12:57
View user's profile Send private message Visit poster's website Reply with quote
r22



Joined: 27 Dec 2004
Posts: 805
r22
You can shave bytes off the code part by assuming eax will be 0 at start and setting up the stack before the calls.
Code:
;;same code minus the xor eax,eax
push eax
call @f
db 'small',0
@@:
call @f
db 'hello fasm.',0
@@:
push eax
call @f
db 'user32',0
@@:
call LoadLibrary
Call MessageBox
ret
    

doesn't shrink the resulting file size though o well
Post 19 Oct 2005, 21:58
View user's profile Send private message AIM Address Yahoo Messenger Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
i don't think we can create any smaller file than this.. btw, anyone can try this on other Windows version (9x, etc)?? not sure whether it can be run on all version of Windows.
Post 20 Oct 2005, 01:35
View user's profile Send private message MSN Messenger Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
You can do the trick as intro-coders do. Write a program that will pack the whole exe with some strong compress algo (but small depacking routine needed) and write the result to the .com file. Given .com file would consist of the depacking routine and code that will run the program after decompression. But as the method is rather good (20kB to 4kB even) I don't know will the ratio be lower than 100% even after compression as the data is really small

Ancient One: It won't work under win9x. First: win9x loader works only on files >=1024 bytes. Second: Addresses here are hardcoded and they are different on nt-based and on 9x systems. Third: On win9x eax is equal to ImageBase at the beginning, and on nt-based it's equal zero (and this functionality, we have used to shrink the code even more).
Post 20 Oct 2005, 20:05
View user's profile Send private message Visit poster's website Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
rev, i dont think thats true. i remember testing a 300+ bytes pe long time ago and its work fine on win98. i know the hardcoded address must be changed on different windows version.. portability is not the goal here Smile. i just want to create the smallest possible pe program that can be run...just for fun Smile.
Post 21 Oct 2005, 02:31
View user's profile Send private message MSN Messenger Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
As far as I know win9x returns "Program is not correct Win32 Image" or something similar. It doesn't even load it to memory.
Post 21 Oct 2005, 16:51
View user's profile Send private message Visit poster's website Reply with quote
RedGhost



Joined: 18 May 2005
Posts: 443
Location: BC, Canada
RedGhost
if i extend one of the message box strings too far

i get the error "invalid value" on
Code:
rb 64-(sizeof.code)-2-4    
    


would someone please explain to me why this is?

_________________
redghost.ca
Post 22 Oct 2005, 02:37
View user's profile Send private message AIM Address MSN Messenger Reply with quote
vbVeryBeginner



Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia
vbVeryBeginner
Quote:

rb 64-(sizeof.code)-2-4
dd pe_header

pe_header:
.signature dd 'PE'

if u got larger sizeof.code, the 64 - ur size would result negative value.
Post 22 Oct 2005, 03:20
View user's profile Send private message Visit poster's website Reply with quote
RedGhost



Joined: 18 May 2005
Posts: 443
Location: BC, Canada
RedGhost
vbVeryBeginner wrote:
Quote:

rb 64-(sizeof.code)-2-4
dd pe_header

pe_header:
.signature dd 'PE'

if u got larger sizeof.code, the 64 - ur size would result negative value.


doh, that should be pretty obvious Embarassed

hmm, since i dont really understand the inner workings of a pe header, i simply tried to increment 64 to match the changes in the increase of bytes in the code, but that rendered the exe as invalid, it simply creates a console window then exists

_________________
redghost.ca
Post 22 Oct 2005, 03:39
View user's profile Send private message AIM Address MSN Messenger Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
RedGhost.. the dos header is a fixed sized structure.. exactly 0x40 bytes.. i put the Win32 code inside the dos header, between the first field ('MZ' signature) and the last field (offset to nt header).. so, we only have 0x40-2-4 bytes to work on.

Rev, i lost the code and i don't have win98 installed so i cannot put it here.. but i will try to recreate it later.
Post 23 Oct 2005, 00:19
View user's profile Send private message MSN Messenger Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.