HAY Herbert, wanna write a legal PE executable ?
in [ASM]
|
From: Herbert Kleebauer on 7 Sep 2007 15:29 hutch-- wrote: > > So you refuse to enter the ring. > I have long ago been in the ring with the MASM32 project, you are just > hedging because you know you are wrong. I'm wrong? With what? All I want to know is, who has to eat that hat, you or Wannabee. And to make this decision, we need from you: Come up with 10-20 diffrent examples of _complete_ (short) MASM programs, and I will write the RosAsm equivalents. And lets compare them. All called code must be present, except for Win32 API code. Shouldn't be to difficult to extract one example from your megabytes of MASM code which demonstrates that your assembly programming skills together with the "sheer brutal power of MASM" can never be improved by somebody using an other assembler. Come on hutch, show us this example, I'm always keen on learning something new. > > No, I posted pure binary code. Sometime it happens that > > a binary byte is displayed as a 'a' or 'Z'. > > Your talking nonsense, ascii does not display binary, it displays > ascii. ????? A binary file is a sequence of bytes, each byte represents one of 256 different values. "ASCII" is a code which maps characters and some control characters to 7 bit values. There exist 256^922 different binary files with 922 bytes. 128^922 of this binary files are also ASCII files. The one I posted is one of this 128^922 files but it is still a valid binary executable. > > The other way: show me a single 32 bit Windows version where it > > doesn't run. > > I don't have to, Microsoft LINK and DUMPPE both show your EXE is > broken junk. Then maybe you should report to Microsoft, that any of it's 32 bit Windows versions executes "broken junk" instead of refusing it. > > > In a HEX editor it looks like encrypted data. Run the file and is > > > startup is laggy and is a lot slower than the console startup time. > > > > Most binary file looks like "encrypted data" in a hex editor. > > Try telling the truth, every 32 bit PE has a DOS header starting with > MZ. It appears you are unfamiliar with this. Maybe Windows is unfamiliar with this, because Windows executes the program and not I. > > > Who said it need the sheer brutal power of MASM to write a 1024 byte > > > window. It just happens to be the legal minimum size for a 32 bit PE > > > file. > > > > Because you wanted to give us some examples of the "sheer brutal > > power of MASM" and then posted this example. > > No, I gave you more than one 1k legal PE example built in masm. But you wanted to give us some examples of the "sheer brutal power of MASM" and then posted this trivial 1k example. > Something you not yet managed to do with your hand coded junk. You are right, after 922 bytes it was finished. > > > > Ok Hutch, let's see one of your MASM examples so we can decide if it's > > > > possible to improve it using a better assembler. But don't give us a link, > > > > post it right here, the complete source (with all necessary include files) > > > > for a short demo which can be assembled with MASM. > > > > > Done years ago, the MASM32 Project at www.masm32.com. > > > > Then extract the one example which best shows us the "sheer brutal > > power of MASM" and post it here. > > You are in no position to tell me what to do. There are more than > enough examples in the masm32 project. I don't tell you what to do. You told us. Here again your posting which was the beginning of the "eat the hat" story: From: "hutch--" <hu...(a)movsd.com> Newsgroups: alt.lang.asm Subject: Wannabee is a PIKER ! Date: 10 Feb 2005 09:14:46 -0800 Only a few days ago Wannabee flapped his mouth off with the following challenge, ========================================================================= 7 Feb 2005 06:09:17 -0800 Come up with 10-20 diffrent examples of _complete_ (short) MASM programs, and I will write the RosAsm equivalents. And lets compare them. All called code must be present, except for Win32 API code. You formulated this challenge. Now give us the example so we can see who has to eat the hat. > > I always hand code the binaries when doing assembly programming. > > You are talking nonsense here, if you code binary you are not writing > assembler. A real assembly programmer generates each binary byte in the executable himself (by using a symbolic text representation for the binary bytes like "move.b r0,r1" for $88, $c2). > > Ok Hutch, let's see one of your MASM examples so we can decide > > if it's possible to improve it using a better assembler. > > You were also being dishonest about doing a comparison with an > assembler. ????????? > > Only MASM and HLA user let the "assembler" generate code which > > they didn't write explicitly themselves. > > You are also ignorant of the technical details here, MASM assembles > object modules, the LINKER writes the MZ and PE header and sections. > If you know how to write masm you get what you write. Which opcode does MASM generate for a "mov edx,xyz"? > > > What is the big deal, its done with a DOS stub for a standard PE file. > > > > Sure, but I want to see the "sheer brutal power of MASM" to do it > > in a simple and readable way. > > In 16 bit linker use the undocumented /KNOWEAS option from MSDN. > In 32 bit linker use /STUB:yourfile.exe > > Don't you know how to use a linker ? Just give us a complete source code together with all necessary command files to generate the binary, so we can compare the "sheer brutal power of MASM" with some other weak assembler.
From: Jim Carlock on 7 Sep 2007 15:52 What happens if you... (1) Right-click upon cmd.exe, and select copy from the menu. (2) Use Explorer to navigate to a temporary folder, then right- click once again, but select paste. (3) Change the name of the newly created cmd.exe to tmp_cmd.exe. (4) Right-click upon that file and click on "Properties". (5) Click upon the "Compatibility" tab. (6) Set it to run as Windows 95 compatibility. (7) Save the changes and then run your batch file inside of that tmp_cmd.exe prompt. -- Jim Carlock North Carolina Swimming Pool Builders http://www.aquaticcreationsnc.com/
From: hutch-- on 7 Sep 2007 17:42 Herbert, It appears that you are incapable of producing an operating system specified executable as all you have delivered so far is a couple of ASCII notation files that built into illegal broken junk. You have misrepresented your attempt to take up Wannabee's failed challenge by posting examples that were not written in ANY assembler. For you to try this challenge on behalf of Wannabee you have to be able to do what Wannabee promised to do and that is match ANYTHING that MASM can do with Betov's assembler. The ENTIRE MASM32 LIBRARY is available in the MASM32 project at www.masm32.com, either produce the Betov assembler version or start chewin Wannabee's hat. Its time for you to put up or start chewin.
From: �a/b on 7 Sep 2007 17:49 On Fri, 07 Sep 2007 10:28:14 +0200, Herbert Kleebauer wrote: >hutch-- wrote: >> It seems like poor Herbert has been dragged back into defending the >> Betov camp again with his willingness to take up the lance to defend >> Wannabee's efforts in feeding bullsh*t to the members of ALA. > >I defend nobody, as I said in my original post: > > Ok Hutch, let's see one of your MASM examples so we can decide if it's > possible to improve it using a better assembler. But don't give us a link, > post it right here, the complete source (with all necessary include files) > for a short demo which can be assembled with MASM. > >I want to see the result of the challenge to know who has to >eat the hat. It's like you and Wannabe are two boxers and he >says "if I don't knock you out before the 10th round, I will >eat my hat" and you continuously answers "now eat your hat, >you didn't knock me out and you will never do, because I will >never enter the ring with you". > >> Herbert offered a challenge to the sheer brutal power of MASM and > >I didn't offer any challenge, I asked you to post the short >examples from your challenge with Wannabee. But all you posted >was a program with a single nop. Now this is too small for a >real improvement. We don't want your link to megabytes of code >and not a one instruction program, but a short nice example >which shows the "power of MASM" so we can compare it with >the power of other assemblers. Now be man enough and enter >the ring. > >> mentioned another assembler yet his examples are just direct binary in >> ascii format which do not appear to be assembler code at all. > >Seems you are confusing assembly code and machine code. What >I posted was pure machine code and nothing else. > >> Now as everyone and their dog knows, a legal PE executable file can be >> at its minimum 2 * 512 byte sections which total 1024 bytes yet >> Herbert labours under the misapprehension that a hand coded ascii >> binary file of 922 bytes is an executable PE file. > >Now I know that a legal Win32 executable has to have >at least 1024 bytes. And you now know, there is a legal >Win32 application with only 922 byte (ok, it does only >run in 32 bit Windows, so it can't be executed for example >in Win3.1). Maybe you can tell me, what's "illegal" with >the 922 byte Win32 application? Doesn't in correctly >display the message box on any 32 bit Windows? > > >> While further floundering on this problem, here is a 1k working LEGAL >> PE executable window built with MASM. The source code for it is in the >> masm32 project under the name masm1k.exe. >> >> ; F:\masm32\examples\exampl12\masm1k\masm1k.exe 1024 bytes > >Can you please explain which "sheer brutal power of MASM" is >necessary to write a 1024 byte executable which displays a >window? We are still waiting for: > > Ok Hutch, let's see one of your MASM examples so we can decide if it's > possible to improve it using a better assembler. But don't give us a link, > post it right here, the complete source (with all necessary include files) > for a short demo which can be assembled with MASM. > > >But if you really want a second challenge besides the one with >Wannabee you have to provide a little bit more than a 1k program >which displays a window. For example, show me the MASM source >of a program which displays the OS version and where the same exe >works in 16 bit DOS and 32 bit Windows. > >The batch below generates gver.exe which when executed in XP displays: > >set ver_major=00000005 >set ver_minor=00000001 >set ver_build=00000a28 >set ver_platf=00000002 >set ver_csd=Service Pack 2 > >But you can also execute the same gver.exe in DOS 6.2. > > >echo hD1X-s0P_kUHP0UxGWX4ax1y1ieimnfeinklddmemkjanmndnadmndnpbbn>gver.com >echo hhpbbnpljhoxolnhaigidpllnbkdnhlkfhlflefblffahfUebdfahhfkokh>>gver.com >echo wvPp0w(a)h3k9C5/R/pN0d0uDh37bwo1YioGEWtbGov5//B6mkuMEo0IL0l/w>>gver.com >echo ef2iC57R/pNEA/jeefHhC5AR/pNEA/juefXgC5ER/phCfDM(a)m042knfuurC>>gver.com >echo l4Ncl5Bd4k03E53YlzzT0k0gF0/hl70QV2TE(a)AB61WWPqjvY0u31/WEXyT/>>gver.com >echo U7ycf6/uS1/oaEnVUP/ApQ7nJ5RUMLNmxJPVdqPmp2Ak/2Ak/2AkoU1nJ5R>>gver.com >echo UMLNmxJPdtqPmp2Ak/2Ak/2AkoU1nJ5RUMLNmxZMpZ5PYp2Ak/2Ak/2AkoU>>gver.com >echo 1nJ5RUMLNmx4Qg45RapXNaNaNaNaNapU1nJ5RUMLNmxpMnFKDUEGi1/EkUX>>gver.com >echo /A/6Ak3Em23/t8I/o8A/1W4QYsgDslKAw5A/JFLkI/0//ItJeBPQ/s/wE/@>>gver.com >echo 3E0A//0PYUpEY03N/W5/R03N7k43gV03gl0UY00PIk/PE/3L/V5EQ03PI/3>>gver.com >echo Pc/6EQ0DPA43Lkl5Os1RZV6RN/f/N/F53Y00Po/7L/y5zjlrg0l54k83Lc9>>gver.com >echo 3Lc(a)3LMA3PI/NEgF1M0F5EQ0WEgF1u0l47/l5JIpI48pAms1Nglq4g0l56o>>gver.com >echo INnBLMbJaEjVLE/gIFGtIFABXAiE5PgR0bEQVeEQViEQVlEgl04VLOo0ZQj>>gver.com >echo BKNnBL56J5RHF6N74aPYlKNOQZQdFLN5Z5PZZlFZFbJZ8rQdxaP4VLE/U56>>gver.com >echo G/3/zL04E/3/yOF3/0kjU70E/o(a)0NUCdNgs02SA0c2K5BJbvc@N58uDu(a)aV>>gver.com >echo O/wT47/0E/ALNo0WRZ8rLh4aOj8LD/ALNo0WRZ8rLhZaPj8LD/ALNo0WRZ8>>gver.com >echo rLWJLOgFKD/ALNo0WRZ8rLklKMoNKD/ALNo0WRZ8rLXB6Nx/UJtWE5yuM3/>>gver.com >echo 0Ek/H/W12csD/cy8Mr//9w8/9AA7OVFWXijC50E/US2NspkPQE29/UW5M31>>gver.com >echo /Hr0cDE5f(a)zkWOU3/0EA/DE0I70E/IL2eJzzJk/3/0kcI70E/c5/cVV3/0U>>gver.com >echo O0Ua0G/3/ExT4E/0E/Y/kplVO/Uq0G/3/cRU3/0UO/wT4//0E/c5/zL01E/>>gver.com >echo 3/0q25G/3/0YFRMDA/r8LOoJ57Z8bQj8r58Et5zjVs.>>gver.com >gver.com>gver.exe >del gever.com you have the experience; but the language is with me
From: Wolfgang Kern on 7 Sep 2007 08:18
"hutch--" posted more HAY: You don't got something silly with horses Steve ? > While further floundering on this problem, here is a 1k working LEGAL > PE executable window built with MASM. The source code for it is in the > masm32 project under the name masm1k.exe. > ; F:\masm32\examples\exampl12\masm1k\masm1k.exe 1024 bytes I'm not within your hat-game yet, and I wont join in anyway. Beside the fact that you use a cheated code in header PE, your code look somehow redundant to me even I just view its hexdump. Let's see if I can figure out what it's supposed to do: it contains just 'procedures' (like any other HLL) and moves data around to convert the order and/or parameters. The effictive code I found is only 2c4-208 = c4 (196 dec) bytes. IIRC this example is from the "1KB contest" some time ago. Something like EBC->C conversion or whatsoever, I wont search deeper now even I'm confident that it can be shortened by a few bytes, and of course it can be done to perform faster. __ wolfgang ____________________________________ (org: shown as in file yet, just add the offset) Proc_1: 208 55 PUSH ebp 209 8BEC MOV ebp,esp 20b 83C4B4 ADD esp,-4ch ;= SUB 4ch 20e 33FF XOR edi,edi 210 BE 00004000 MOV esi,400000h 215 BB 00104000 MOV ebx,401000h 21a 68 007F0000 PUSH 00007f00h 21f 57 PUSH edi ;=0 yet 220 FF15 18114000 CALL [00401118] ; 226 C745B4 30000000 MOV [ebp-4ch],00000030h 22d C745B8 03000000 MOV [ebp-48h],00000003h 234 C745BC A4104000 MOV [ebp-44h],004010a4h 'ptr 23b 897DC0 MOV [ebp-40h],edi 23e 897DC4 MOV [ebp-3ch],edi 241 8975C8 MOV [ebp-38h],esi 244 C745D4 10000000 MOV [epb-2ch],00000010h 24b 897DD8 MOV [ebp-28h],edi 24e 895DDC MOV [ebp-24h],ebx 251 897DCC MOV [ebp-34h],edi 254 8945D0 MOV [ebp-30h],eax 257 897DE0 MOV [ebp-20h],edi 25a 8D45B4 LEA eax,[ebp-4c] 25d 50 PUSH eax 25e FF15 1C114000 CALL[0040111c] ; 264 B9 00000080 MOV ecx,80000000h 269 5756575757515751 PUSH edi,esi,edi,edi,edi,ecx,edi,ecx 271 68 0000CF00 PUSH 00cf0000h 276 535357 PUSH ebx,ebx,edi 279 FF15 20114000 CALL[00401120] ; 27f 6A01 PUSHq +01 281 50 PUSH eax 282 FF15 24114000 CALL[00401124] ; 288 8D5DE4 LEA ebx,[ebp-1ch] 28b EB 07 JMP 294 ;"L1" 28d 53 PUSH L0: 28e FF15 28114000 CALL[00401128] ; L1: 294 57 57 57 53 - 298 FF15 2C114000 39e 84 C0 TEST AL,AL 2A0 75 EB JNZ 28e ;"L0" 2a2 C9 LEAVE 2a3 C3 RET _____ Proc_2: 2a4 55 PUSH ebp 2a5 8B EC MOV ebp,esp 2a7 837D0C02 CMPq[ebp+0ch],+02h 2ab 75 08 JNZ 2b5 ;"L2" 2ad 6A 00 PUSHq 0 2af FF15 30114000 CALL[00401130] ; L2: 2b5 FF7514 PUSH [ebp+14h] 2b8 FF7510 PUSH [ebp+10h] 2bb FF750C PUSH [ebp+0ch] 2be FF7508 PUSH [ebp+08h] 2c1 FF15 34114000 CALL [00401134] ; 2c7 C9 LEAVE 2c8 C2 10 00 RET 0010h LX: ;not accessed 2cb CC INT3 2cc F4 10 00 00 HALT ;DATA+Thunk ?: > 000002D0 :00 00 00 00 00 00 00 00 - C4 11 00 00 18 11 00 00 > 000002E0 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 > 000002F0 :00 00 00 00 3C 11 00 00 - 4A 11 00 00 5E 11 00 00 > 00000300 :70 11 00 00 7E 11 00 00 - 92 11 00 00 A0 11 00 00 > 00000310 :B2 11 00 00 00 00 00 00 - 3C 11 00 00 4A 11 00 00 > 00000320 :5E 11 00 00 70 11 00 00 - 7E 11 00 00 92 11 00 00 > 00000330 :A0 11 00 00 B2 11 00 00 - 00 00 00 00 80 01 4C 6F L o > 00000340 :61 64 43 75 72 73 6F 72 - 41 00 C8 01 52 65 67 69 a d C e b c R e g i > 00000350 :73 74 65 72 43 6C 61 73 - 73 45 78 41 00 00 54 00 s t e r C l a s s A > 00000360 :43 72 65 61 74 65 57 69 - 6E 64 6F 77 45 78 41 00 C r e a t e W i n d o w A > 00000370 :2D 02 53 68 6F 77 57 69 - 6E 64 6F 77 00 00 8C 00 S h o w W i n d o w > 00000380 :44 69 73 70 61 74 63 68 - 4D 65 73 73 61 67 65 41 D i s p a t c h M e s s a g s A > 00000390 :00 00 19 01 47 65 74 4D - 65 73 73 61 67 65 41 00 G e t M e s s a g e A > 000003A0 :BF 01 50 6F 73 74 51 75 - 69 74 4D 65 73 73 61 67 P o s t q u i t M e s s a g > 000003B0 :65 00 7E 00 44 65 66 57 - 69 6E 64 6F 77 50 72 6F e D e f W i n d o w P r o > 000003C0 :63 41 00 00 75 73 65 72 - 33 32 2E 64 6C 6C 00 00 c A u s e r 3 2 . d l l > 000003D0 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 > 000003E0 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 > 000003F0 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 > |