Working execuable with no imports

f0dder wrote:

Quote:

My Win2K system rejects all executables with a blank import table because of a bug in NTDLL.DLL. It tries to call a Kernel32.DLL function when Kernel32.DLL is not even loaded!

Dunno if you can classify it as a bug, it's simply the way the loader works. I'd say it's more buggy that no-imports actually work on other versions, by having kernel32.dll forced into your address space even if you don't use it

Quote:

Spidark: Interesting that the virus scanner detects some non-existant virus. What scanner program do you use?

Either it does heuristic scanning, or a simple wildcard pattern match. These no-import executables tend to look alike. I'd say it's a good call for the virus scanner to be suspicious, since you rarely ever see valid executable that are built this way.

Anyway, forget about McAfee. BitDefender is okayish (even if unstable on win9x), the real deal is kaspersky and f-prot. And of course a trusty hex editor and disassembler.

im no windows expert but isnt it wrong for this to work on xp as kernel32.dll isnt in the import section.
why should it be loaded if its not in the import section which is there to show which functions you need ?

"I'd say it's more buggy that no-imports actually work on other versions, by having kernel32.dll forced into your address space even if you don't use it Smile

"
i would agree with that, but i dont really know that much about PE files, windows internals etc.

i tested the attachment, and it works on my xp sp2 system, but not on my win2k sp4 system. same as revolution.