flat assembler
Message board for the users of flat assembler.
![]() Goto page 1, 2 Next |
Author |
|
vid 04 Apr 2006, 11:10
discussed already
look for self-overwriting exe or so maybe it could go to interesting threads |
|||
![]() |
|
Kermil 04 Apr 2006, 11:15
Quote:
It is wrong way, because some antiviruses will be locking your program, when you will try to write in a exe-file. |
|||
![]() |
|
RedGhost 04 Apr 2006, 12:59
moriman wrote: Hi, just use the registry in this case _________________ redghost.ca |
|||
![]() |
|
moriman 04 Apr 2006, 13:13
OK, thx all for the replies
![]() mori |
|||
![]() |
|
Madis731 04 Apr 2006, 13:23
There was a self-deleting file example somewhere around these forums - if you find it - you may aswell find a way to change it.
The problem (or the difference from deleting) is that when you change that file, you need to mess with the PE headers again meaning you should have the source and FASM packed with your executable so you can reassemble it. Changing one byte might not harm a PE file, like changing the first instructino to INT3 to debug it ![]() |
|||
![]() |
|
Plue 04 Apr 2006, 19:02
You can change bytes inside the exe but don't add or remove them. Also you can add as much as you want to the end.
|
|||
![]() |
|
okasvi 04 Apr 2006, 20:38
id go for having separate section for doing it and then CreateRemoteThread to modify those settings which does wait until app is closed and then change them to your exe... look for comrade's selfsave example(masm)...
_________________ When We Ride On Our Enemies support reverse smileys |: |
|||
![]() |
|
Reverend 28 May 2006, 14:44
Madis731: In fact it isn't such difficult. You don;t have to have a copy of FASM and your sources to reassemble everything. It can all be calculated. Like every PE packer/protector do. They get all values to be written in PE header during runtime.
|
|||
![]() |
|
f0dder 28 May 2006, 17:52
Plue: and how do you do this in a way that works from win95 to XP SP2?
![]() |
|||
![]() |
|
r22 29 May 2006, 05:48
IMHO people seem to over complicate the task of self modifying an exe file at runtime. Especially if the information you wish to store is of a static size or a size that is no greater than a set limit.
I'll elaborate further, While an EXE file is running you still have... - Readonly access to the EXE file - Ability to rename the file So all your exe file has to do to edit itself is... 1- Rename itself to (ie: deleteme.exe) 2- Make a copy of itself with the correct EXE name 3- Edit the copy using the file io APIs 4- Run the copy and shutdown the old instance 5- The copy should have a short procedure at the beginning to deletefile "deleteme.exe". People talking about adding sections and using PE analyses seems excessive Code: .data ... ;;A short unique string of bytes to make editing easier PointerToStart dq 0ABCDEF99ABCDEF99, 11111111AAAAAAAAh SavedRecordSpace dq 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ;;or use DUP Now in step three you only need a simple loop going through the mapped view of the file searching for your unique string and changing the bytes after it to your new saved record data. |
|||
![]() |
|
f0dder 29 May 2006, 13:14
Quote:
Not on win9x... Besides, the rename-modify-relaunch will make your application "flicker in and out of existance" if you have any open windows (obviously), this looks pretty ugly. |
|||
![]() |
|
rugxulo 29 May 2006, 20:36
Or you could just use environment variables to change default behavior. Much cleaner than worrying about rewriting .EXEs, IMO.
|
|||
![]() |
|
r22 29 May 2006, 22:06
rugxulo, using the registry is obviously the correct solution, but it's out of the scope of this particular thread.
f0dder, you could have the new instance close the old one, so the it would be more of an overlap then a flicker. But for serious use the only case where my method would be aesthetically viable would be if the data only needed to be saved at the shutdown of the program. (Because then no restart/flicker would be necessary) AND how much longer do we have to make our code coddle win9x. It's newest iteration is 8yrs old. Not that it's a bad OS or anything, it's just antique ![]() |
|||
![]() |
|
Borsuc 30 May 2006, 18:06
r22 wrote: AND how much longer do we have to make our code coddle win9x. It's newest iteration is 8yrs old. Not that it's a bad OS or anything, it's just antique ![]() Okay, I'm no Microsoft old-product-lover, and I certainly don't say Win9x has higher quality than Win2K, but it was only an example. Take your time and analyze those things, and then say what most people say, that products are being poorer (sorry, can't find better word) by age. This is nonsense. Those who say that are usually spoilt people... ![]() Personally, if I was in charge of the world, I would let people appreciate all things, and only give them the "cooler toys" after they appreciated the "old toys". This way will they understand everything and not be blinded by "toys will suck in time, cooler is magic, etc.." and then they'll see the truth about it. About your method: I see it as kinda brute-force one.. I simply don't like it (of course no offense)... And Registry sucks!! Imagine what kind of trash is in there!! If all programs had only .ini we wouldn't even need to install them -- we could just copy them (if we had information, of course). The only thing that has to be modified this way will be the application path, but that's not a big deal, since it can be obtained with APIs, so why write it in Registry. From my point of view, Registry was one of the bad designs of Windows -- it grew so popularily that we simply have to live with it ![]() |
|||
![]() |
|
f0dder 30 May 2006, 18:13
Quote:
The registry has pretty fast data access, though - you don't need to parse text files, and it has binary search to look up keys. The downside is that many people forget to defrag their drives... ![]() |
|||
![]() |
|
Borsuc 30 May 2006, 18:14
Why not make .ini binary then, and a .ini editor like regedit?
|
|||
![]() |
|
donkey7 30 May 2006, 18:38
you can make small registry for each program
![]() |
|||
![]() |
|
Borsuc 30 May 2006, 18:40
Yes I know, but it still adds up in the Registry after you "apply it". That's why you need Registry cleaners and no Ini cleaners.
|
|||
![]() |
|
f0dder 30 May 2006, 18:43
The only real advantage of registry cleaners is to clean up COM components and filetype associations, stuff like that. They don't speed up your system because entries are removed, really, but because of the type of entries they clean up...
|
|||
![]() |
|
Goto page 1, 2 Next < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.