flat assembler
Message board for the users of flat assembler.

Index > Windows > Smallest Win32 PE..

Goto page Previous  1, 2
Author
Thread Post new topic Reply to topic
RedGhost



Joined: 18 May 2005
Posts: 443
Location: BC, Canada
RedGhost
Ancient One wrote:
RedGhost.. the dos header is a fixed sized structure.. exactly 0x40 bytes.. i put the Win32 code inside the dos header, between the first field ('MZ' signature) and the last field (offset to nt header).. so, we only have 0x40-2-4 bytes to work on.

Rev, i lost the code and i don't have win98 installed so i cannot put it here.. but i will try to recreate it later.


ah, ok thanks for clarifying

_________________
redghost.ca
Post 23 Oct 2005, 00:29
View user's profile Send private message AIM Address MSN Messenger Reply with quote
SDragon



Joined: 13 Sep 2005
Posts: 19
Location: Siberia
SDragon
Some guy called server2000 had published 153 bytes exe with no hardcoded addresses. Here is his article in Russian:

http://www.xakep.ru/post/21399/default.asp

Some fields in headers are overlayed, "MZ..PE" used as message. IMHO, this should be interesting for you.


Description: 153 bytes exe
Download
Filename: mzpe153.zip
Filesize: 240 Bytes
Downloaded: 288 Time(s)

Post 24 Oct 2005, 10:07
View user's profile Send private message Reply with quote
Chewy509



Joined: 19 Jun 2003
Posts: 297
Location: Bris-vegas, Australia
Chewy509
polygon7 wrote:
shism2 wrote:
You could probably make it even smaller ...... I think by using some hash routines......
I think you can't - hash proc will be equal in size or greater than exe shown above.

I saw something similar (smallest PE exe) in Assembly Programming Journal (i think it was in vol 2).


This article:Google Cache of vol2 ?
Post 25 Oct 2005, 01:33
View user's profile Send private message Visit poster's website Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
wow.. thats really cool..can anyone help translate the article to english please???
Post 25 Oct 2005, 03:43
View user's profile Send private message MSN Messenger Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
i done the overlapping header before but it didn't work so i thought it never will work.. silly me!
Post 25 Oct 2005, 03:50
View user's profile Send private message MSN Messenger Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
ya someone transalate it to english... babelfish does an OK trans but not clear enough
Post 25 Oct 2005, 04:28
View user's profile Send private message Reply with quote
polygon7



Joined: 14 Aug 2003
Posts: 62
Location: Poznan, Poland
polygon7
Chewy509 wrote:
This article:Google Cache of vol2 ?
Yes, it is. Smile

_________________
best regards
p7
Post 25 Oct 2005, 07:13
View user's profile Send private message Visit poster's website Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
now here a really small exe based on the 153 bytes program.. (but it still use hardcoded address that run in xp sp-0). it's 98 bytes in size
Code:
use32
image_base equ 0x400000

 dos_header:
dw 'MZ'
dw 0

 nt_header:
dd 'PE'
dw 0x14c, 0
main:
push user32+image_base
call 0x77e805d8-image_base
jmp next1

dw sizeof_optional_header
dw 0x10e

 optional_header:
dw 0x10b
next3:
push eax
call 0x77d6add7-image_base
ret
user32 db 'user32', 0
dd main
next2:
push user32+image_base
jmp next3
rb 1
dd image_base
dd 4, 4
dw 4, 1, 0, 0, 3
next1:
xor eax, eax
push eax eax
jmp next2
dd sizeof_image
dd sizeof_headers
rb 4
dw 2
sizeof_optional_header = $-optional_header
sizeof_headers=sizeof_optional_header
sizeof_image=$

    
Post 26 Oct 2005, 05:55
View user's profile Send private message MSN Messenger Reply with quote
estrang



Joined: 02 Nov 2005
Posts: 38
estrang
Code:
LoadLibrary equ 0x7c801d77-image_base ;hardcoded address 
MessageBox equ 0x77d804ea-image_base  ;hardcoded address    


Where did you guys get these stuffs(addresses)?? Disassemblimg?
Post 16 Nov 2005, 13:28
View user's profile Send private message Reply with quote
RedGhost



Joined: 18 May 2005
Posts: 443
Location: BC, Canada
RedGhost
estrang wrote:
Code:
LoadLibrary equ 0x7c801d77-image_base ;hardcoded address 
MessageBox equ 0x77d804ea-image_base  ;hardcoded address    


Where did you guys get these stuffs(addresses)?? Disassemblimg?


well you could disassemble or debug, but the easiest way would be to call GetProcAddress then log the address

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/getprocaddress.asp

_________________
redghost.ca
Post 16 Nov 2005, 16:28
View user's profile Send private message AIM Address MSN Messenger Reply with quote
chris



Joined: 05 Jan 2006
Posts: 62
Location: China->US->China->?
chris
well, let's say it should be called the smallest 'hello world' win32 PE,
what if the program does nothing but ret immediately after it is loaded by windows loader? it would be definitely smaller Smile
Post 05 Jan 2006, 05:19
View user's profile Send private message Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
not really chris... the code itself use part of unused header so less code does not make it smaller.

the address can be found easily using any PE dump sort of programs.
Post 12 Jan 2006, 05:29
View user's profile Send private message MSN Messenger Reply with quote
chris



Joined: 05 Jan 2006
Posts: 62
Location: China->US->China->?
chris
okey, I think I got your idea, Ancient One, thanks.

I guest the most tricky part is that the section alignment field
in image_optional_header32 has an offset 60 (after padding 2bytes following 'MZ') which is exactly the offset of e_lfanew in image_dos_header. This makes the two headers "merged" together Smile

For you guys want to run it in WinXP SP2, just change
0x77e805d8 to 0x7c801d77(LoadLibraryA) and
0x77d6add7 to 0x77d804ea(MessageBoxA) both of them
have new addresses in SP2.
Post 12 Jan 2006, 08:54
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.