PE Console: What happens if no data in data section?

Index > Windows > PE Console: What happens if no data in data section?

Author

Thread

system error

Joined: 01 Sep 2013
Posts: 670

system error 04 Nov 2013, 13:09

Just wondering if this is a bug or not.

Code:

format PE console
include 'win32ax.inc'
entry text

section 'code' code executable
text:
cinvoke printf, "Test!"
invoke system, "pause>NULL"
invoke exit,0

section 'data' data readable writable
;foo dd ?

section 'idata' import data readable
library msvcrt, 'msvcrt.dll'
import msvcrt, system,'system',printf,'printf',exit,'exit'

The console window won't come out, but runs perfectly if i enabled the foo in the data section or if I discarded the data section all together. Thx.

04 Nov 2013, 13:09

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20566
Location: In your JS exploiting you and your system

revolution 04 Nov 2013, 15:09

This is a bug, but not with fasm. Windows has a bug with exe files that have empty sections. The PE spec allows empty sections but the OS is not following the spec properly. If you really need it fixed the you can write to MS and ask for them to make an update.

04 Nov 2013, 15:09

AsmGuru62

Joined: 28 Jan 2004
Posts: 1700
Location: Toronto, Canada

AsmGuru62 04 Nov 2013, 16:08

Yes, I got that too recently.
Weird, but if I add anything in data section - it loads OK.

04 Nov 2013, 16:08

system error

Joined: 01 Sep 2013
Posts: 670

system error 14 Nov 2013, 14:34

revolution wrote:

This is a bug, but not with fasm. Windows has a bug with exe files that have empty sections. The PE spec allows empty sections but the OS is not following the spec properly.

Thanks.

revolution wrote:

If you really need it fixed the you can write to MS and ask for them to make an update.

hmmm... sounds promising.

14 Nov 2013, 14:34

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 15 Nov 2013, 04:15

revolution wrote:

This is a bug, but not with fasm. Windows has a bug with exe files that have empty sections. The PE spec allows empty sections but the OS is not following the spec properly. If you really need it fixed the you can write to MS and ask for them to make an update.

Hmm... That's like telling Google to revert the YouTube layout.

@OP
I just do dummy dd 0

15 Nov 2013, 04:15

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20566
Location: In your JS exploiting you and your system

revolution 15 Nov 2013, 04:44

typedef wrote:

Hmm... That's like telling Google to revert the YouTube layout.

If enough people complain then it might happen.

15 Nov 2013, 04:44

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum