flat assembler
Message board for the users of flat assembler.
Index
> Windows > Possible bug when handling "data" section flag |
Author |
|
revolution 08 Dec 2017, 03:13
The name of the section is arbitrary. You can name it anything (yes really, even a empty string) the loader completely ignores the name. You can also have many sections all named the same with the same flags. The loader won't care, and it is not prohibited by the PE specs. You can name your data section ".text" and your code section ".data" if you want to. The names are just a tradition, not a requirement.
|
|||
08 Dec 2017, 03:13 |
|
Ben321 08 Dec 2017, 05:18
revolution wrote: The name of the section is arbitrary. You can name it anything (yes really, even a empty string) the loader completely ignores the name. You can also have many sections all named the same with the same flags. The loader won't care, and it is not prohibited by the PE specs. You can name your data section ".text" and your code section ".data" if you want to. The names are just a tradition, not a requirement. Is it possible then maybe to have more control of FASM's behavior, so that you can tell it not to have BaseOfData point to the exports section .edata? That way it would mimick the behavior of other assemblers and linkers that I've seen. I'm pretty sure that it's not correct PE specs to have BaseOfData point to a section with special purpose (such as the section containing the export table, typically called .edata). I believe that BaseOfData is supposed to only point to a section containing generic data, as is typically found in the .data section. |
|||
08 Dec 2017, 05:18 |
|
revolution 08 Dec 2017, 05:38
Export data, and import data, do not have to be in a separate section. They are just data actually and can appear anywhere that other data appears. As long as the PE headers correctly point to the data (in whatever section it appears) then everything is okay.
You can use the "data" directive to put values into the PE header: Code: data 12 ;PE header offset 12 will point to this data db 'random data' ;blah end data the manual wrote: data directive begins the definition of special PE data, it should be followed by one of the data identifiers (export, import, resource or fixups) or by the number of data entry in PE header. The data should be defined in next lines, ended with end data directive. When fixups data definition is chosen, they are generated automatically and no more data needs to be defined there. The same applies to the resource data when the resource identifier is followed by from operator and quoted file name – in such case data is taken from the given resource file. |
|||
08 Dec 2017, 05:38 |
|
Tomasz Grysztar 08 Dec 2017, 07:34
Ben321 wrote: Is it possible then maybe to have more control of FASM's behavior, so that you can tell it not to have BaseOfData point to the exports section .edata? Code: if DATA_SIZE = 0 & MAGIC <> 0x20B load DATA_BASE from PE:SectionTable.VirtualAddress+SECTION_INDEX*SectionTable.ENTRY_LENGTH store DATA_BASE at PE:OptionalHeader.BaseOfData end if |
|||
08 Dec 2017, 07:34 |
|
Ben321 08 Dec 2017, 10:14
Is it currently possible in just plain fasm (not fasmg) to write custom data to the PE header?
|
|||
08 Dec 2017, 10:14 |
|
revolution 08 Dec 2017, 10:59
Ben321 wrote: Is it currently possible in just plain fasm (not fasmg) to write custom data to the PE header? Last edited by revolution on 08 Dec 2017, 11:00; edited 1 time in total |
|||
08 Dec 2017, 10:59 |
|
Tomasz Grysztar 08 Dec 2017, 11:00
Ben321 wrote: Is it currently possible in just plain fasm (not fasmg) to write custom data to the PE header? It is possible to patch the headers with a second stage of assembly with directives like FILE and STORE, but this would require some sort of batch assembly (or a tool like "make"). |
|||
08 Dec 2017, 11:00 |
|
Furs 08 Dec 2017, 13:03
AFAIK, BaseOfData is a completely useless field. Why do you care so much about it?
Sections aren't important except in rare cases (.rsrc is special, maybe .reloc too I forgot). Other than that, sections really don't matter. Most of those fields don't matter either. What matters in PE are the data directories. Those are the only thing that the loader cares of when doing imports/exports and other special stuff like relocation directory, TLS etc. Make sure the export/import directories are properly set (they are the first two directories, respectively). |
|||
08 Dec 2017, 13:03 |
|
revolution 08 Dec 2017, 13:20
Furs wrote: Sections aren't important except in rare cases (.rsrc is special, maybe .reloc too I forgot). Other than that, sections really don't matter. Most of those fields don't matter either. .reloc: Not special, can be mixed in with normal data sections. No problem. Indeed the entire program, including data, code, imports, exports, resources, relocation, etc., can all reside in one giant combined section. And you can name it "IHAZALL". Although some AVs may go into major panic mode. |
|||
08 Dec 2017, 13:20 |
|
Furs 09 Dec 2017, 00:03
I'm pretty sure I read .rsrc is special in some MSDN doc (or blog post by MS employee), or rather Microsoft strongly encourage to not mess with it. Unfortunately, can't seem to find it anymore.
Probably it's because many applications scan resources by section and name instead of the resource directory, or something like that. |
|||
09 Dec 2017, 00:03 |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.