flat assembler
Message board for the users of flat assembler.
Index
> Windows > Section writable at runtime? Goto page Previous 1, 2 |
Author |
|
Azu 17 Feb 2009, 11:59
Oh. Whenever I see that error I think it is 16-bit. Sorry.
So it means it won't work on anything except DOS? Damn. I guess that's even worse lol. |
|||
17 Feb 2009, 11:59 |
|
revolution 21 Feb 2009, 18:33
Here is the topic I started with the no-import source code.
It is not much use for anything, and won't help any virus code to avoid detection from an AV. But it might be instructive for something. |
|||
21 Feb 2009, 18:33 |
|
pal 21 Feb 2009, 19:37
Thats very impressive revolution, works for me fine.
By the way revolution, how long have you been programming ASM for (as in all ASM if you did stuff before x86 too). |
|||
21 Feb 2009, 19:37 |
|
revolution 22 Feb 2009, 01:57
I've programmed a few different CPUs: 8085, Z80, 6802, 1802, x86, ARM and also some custom built mainframe CPUs a long time ago.
|
|||
22 Feb 2009, 01:57 |
|
Azu 22 Feb 2009, 06:23
pal wrote: The code which revolution posted is 32 bit, and wont work in DOS (you can tell this because it has the PE headers). pal wrote: As for your question, I am no expert by a long shot, but if you have no imports, which I have seen before, you can still call all the APIs you want to. You do something called kernel walking. pal wrote: Also to me it sounds a bit like you are programming malware... In my main forums we see it a lot; people asking for ways to defeat anti-virus heuristics using. Not saying you are doing that, but its generally what people with these sorts of questions are doing... No, I could obviously just make a special case in my import loop for VirtualProtect (like I already have to do with LoadLibrary ) if my goal was to make some malware easily. I want to make the smallest program for win32/win64 possible, though. So I'm trying to find a smaller way. I was hoping there might be a few opcodes I could just use instead. Or a way to make a writable section in the PE without adding 512 bytes.. |
|||
22 Feb 2009, 06:23 |
|
pal 22 Feb 2009, 13:00
You can make the code section of your program writable if you want to, not too sure if it will help you achieve much here though.
There is a topic from a while ago which talks about the smallest PE file possible, here is the link: Code: http://board.flatassembler.net/topic.php?t=5957&postdays=0&postorder=asc&start=0 Also, you don't have to save the addresses. What you do is you program a function which will do the following: Before you call the function push the variables for the API to the stack. 1. Find the kernels offset in memory. 2. Find the offset to the function you want (maybe GetProcAddress, but you'll need to push more parameters for that). 3. Call the API using the offset. But you will need to find a way to store the APIs aliases in the file without using a data section, you may be able to in the code section I dunno. I've seen things like this done before, so don't give up. And if it says "Is not a valid Win32 application", it could mean that the headers are wrong and so it wont work. |
|||
22 Feb 2009, 13:00 |
|
Azu 22 Feb 2009, 15:18
pal wrote: You can make the code section of your program writable if you want to, not too sure if it will help you achieve much here though. pal wrote: There is a topic from a while ago which talks about the smallest PE file possible, here is the link: pal wrote:
pal wrote:
I've seen things like this done before, so don't give up. pal wrote: And if it says "Is not a valid Win32 application", it could mean that the headers are wrong and so it wont work. P.S. thanks for the suggestions.. |
|||
22 Feb 2009, 15:18 |
|
pal 22 Feb 2009, 20:02
You can have more than one section, but if you build the PE headers yourself you enable yourself the option to realign the sections. By standard PE sections (i.e. data, code, imports etc.) are aligned to a minimum of 512 bytes, hence the minimum file size of a PE file is meant to be 512 bytes, but you can change this by manually building the PE file.
What OS are you running; a 64-bit OS? The codes (apart from the last one; the 207 byte one) on that link I gave you all run fine on 32-bit Windows Vista SP1. Also you should note that any EXE without imports will fail on Win2K. This I believe is because the kernel wont be loaded into the file unless a function from it is needed. One more thing, to my knowledge you wont be able to call any APIs if you don't push your variables to the stack; otherwise what arguments would it be using. |
|||
22 Feb 2009, 20:02 |
|
Azu 25 Feb 2009, 09:52
pal wrote: You can have more than one section, but if you build the PE headers yourself you enable yourself the option to realign the sections. By standard PE sections (i.e. data, code, imports etc.) are aligned to a minimum of 512 bytes, hence the minimum file size of a PE file is meant to be 512 bytes, but you can change this by manually building the PE file. pal wrote: Also you should note that any EXE without imports will fail on Win2K. This I believe is because the kernel wont be loaded into the file unless a function from it is needed. If anyone can say how to get an import section without adding extra 512 bytes I will use it instead.. but so far nothing I've found runs for me.. pal wrote: One more thing, to my knowledge you wont be able to call any APIs if you don't push your variables to the stack; otherwise what arguments would it be using. |
|||
25 Feb 2009, 09:52 |
|
Goto page Previous 1, 2 < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.