flat assembler
Message board for the users of flat assembler.

Index > Windows > PE Structures in FASM?

Author
Thread Post new topic Reply to topic
kilobyte



Joined: 07 Jun 2008
Posts: 15
kilobyte
Hey guys, I'm learning about the PE file format by coding a pe dumper which dumps information about the internal structures of PE. I was reading a tutorial about the format and it explained that some structures are defined in windows.inc(guessing that comes from masm) and winnt.h(old article i guess). Anyways i was just wondering if such structures are defined in FASM includes. Though I believe that they are not as i've looked through them and could only find equates and macros. So in conclusion would that mean that I would have to define those structures myself. Just need some confirmation. Thanks in advance.
Post 19 Jun 2009, 14:04
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
PE is complicated, you can take a look at the manual PE method -- except for sections which have complicated macros, everything else is easy to understand I hope. Hope it helps.
Post 20 Jun 2009, 01:48
View user's profile Send private message Reply with quote
kilobyte



Joined: 07 Jun 2008
Posts: 15
kilobyte
Thanks for the link. I've got the PE Specification and have been making notes, and writing structures out in an include file...i'm not looking to produce pe files, just simply dump information about them. With the specification PE doesn't look all too complicated, but i guess i shall see if that statement holds once i start coding.
Post 20 Jun 2009, 11:30
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
By complicated I mean that it has a lot of redundant data or data that is in 2 places but points to the same thing or is dependent on other data etc.., Good luck.
Post 21 Jun 2009, 00:13
View user's profile Send private message Reply with quote
pal



Joined: 26 Aug 2008
Posts: 227
pal
Just copy the information into the PE headers and then dump all the information to file. It wont be hard for you to map the file and do this.
Post 21 Jun 2009, 08:45
View user's profile Send private message Reply with quote
kilobyte



Joined: 07 Jun 2008
Posts: 15
kilobyte
pal wrote:
Just copy the information into the PE headers and then dump all the information to file. It wont be hard for you to map the file and do this.


Yep this was what i was planning on doing...i've almost completed my PE include file containing the constants and structures.
Post 21 Jun 2009, 14:37
View user's profile Send private message Reply with quote
kilobyte



Joined: 07 Jun 2008
Posts: 15
kilobyte
I was just wondering what the difference between

Quote:

dd 0

and
Quote:

dd ?



From the fasm manual
Quote:

All data definition directives also accept the ? value, which
means that this cell should not be initialized to any value and the effect is
the same as by using the data reservation directive. The uninitialized data
may not be included in the output file, so its values should be always
considered unknown.

Does that mean that if say variable 'example dd ?' isn't used throughout the program then it wouldn't be included in the final compiled executable.
Post 21 Jun 2009, 15:11
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
dd ? is UNINITIALIZED data, it is not stored in the executable but put in memory when it is loaded (presumably with random data, so don't depend on initialization).

e.g: it's like allocating memory, only that the .exe loader does it for you. You can allocate as much as you want, but it won't take up much space in your executable (apart from the data used to tell it how much to allocate Very Happy).

_________________
Previously known as The_Grey_Beast
Post 21 Jun 2009, 16:09
View user's profile Send private message Reply with quote
arigity



Joined: 22 Dec 2008
Posts: 45
arigity
if you do something like the following though, it WILL take up space.

Code:
this dd 45425
idk  dd ? ; cuz its between other defined data it will take up space.
true dd 1    


you need to put uninitialized data at the end of a section for it to not take up space in the final exe.
Post 21 Jun 2009, 16:54
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.