HAY Herbert, wanna write a legal PE executable ?
in [ASM]
|
From: hutch-- on 7 Sep 2007 18:56 Wolfgang, Why would you try and get involved in the bulsh*t that rages in ALA ? i thought you were a programmer interested in programming. > You don't got something silly with horses Steve ? HAY, its wot 'orses eat. HAY, its also SHOUTING. > > While further floundering on this problem, here is a 1k working LEGAL > > PE executable window built with MASM. The source code for it is in the > > masm32 project under the name masm1k.exe. > > ; F:\masm32\examples\exampl12\masm1k\masm1k.exe 1024 bytes > > I'm not within your hat-game yet, and I wont join in anyway. If you are not up to it, stay out of it. > Beside the fact that you use a cheated code in header PE take it up with Microsoft, they produce the linker specs for windows 32 bit PE files. > Let's see if I can figure out what it's supposed to do: Whats there to figure out ? Here is a deviant version of masm1k that is nearly as badly written as the trash you see in ALA from time to time. You will need user32.lib from masm32 to build it. It was written as a demo of how NOT to write assembler code. .686p .model flat, stdcall option casemap :none externdef _imp__DispatchMessageA@4:PTR pr1 m2wp equ <_imp__DispatchMessageA@4> externdef _imp__GetMessageA(a)16:PTR pr4 gms equ <_imp__GetMessageA(a)16> externdef _imp__DefWindowProcA(a)16:PTR pr4 dpro equ <_imp__DefWindowProcA(a)16> externdef _imp__PostQuitMessage@4:PTR pr1 pqm equ <_imp__PostQuitMessage@4> externdef _imp__RegisterClassExA@4:PTR pr1 scln equ <_imp__RegisterClassExA@4> externdef _imp__ShowWindow@8:PTR pr2 wshw equ <_imp__ShowWindow@8> externdef _imp__LoadCursorA@8:PTR pr2 lsc equ <_imp__LoadCursorA@8> externdef _imp__CreateWindowExA(a)48:PTR pr12 crwe equ <_imp__CreateWindowExA(a)48> includelib \masm32\lib\user32.lib .code ims db "Slick Huh ?", 0 pcl dd ims slick_huh: push ebp mov ebp, esp sub esp, 96 push 32512 xor edi, edi push edi mov esi, 4194304 mov ebx, pcl call lsc mov DWORD PTR [ebp-96], 48 mov DWORD PTR [ebp-92], 3 mov DWORD PTR [ebp-88], OFFSET wpep mov DWORD PTR [ebp-84], edi mov DWORD PTR [ebp-80], edi mov DWORD PTR [ebp-76], esi mov DWORD PTR [ebp-72], edi mov DWORD PTR [ebp-68], eax mov DWORD PTR [ebp-64], 10h mov DWORD PTR [ebp-60], edi mov DWORD PTR [ebp-56], ebx mov DWORD PTR [ebp-52], edi lea eax, [ebp-96] push eax call scln mov ecx, -2147483648 push 1 push edi push esi push edi push edi push edi push ecx push edi push ecx push 13565952 push ebx push ebx push edi call crwe push eax call wshw lea ebx, [ebp-48] push edi push edi push edi push ebx jmp mlep @@: push edi push edi push edi push ebx push ebx call m2wp mlep: call gms test al, al jnz @B leave retn wpep: cmp DWORD PTR [esp+8], 2 jne @F push 0 call pqm @@: jmp dpro end slick_huh Build it with this batch file. @echo off if exist %1.obj del slickhuh.obj if exist %1.exe del slickhuh.exe \masm32\bin\ml.exe /c /coff slickhuh.asm \masm32\BIN\PoLink.exe /SUBSYSTEM:WINDOWS /merge:.text=.slik / merge:.data=.slik slickhuh.obj dir slickhuh.* pause
From: Wolfgang Kern on 7 Sep 2007 18:52 "Frank Kotler" <fbkotler(a)verizon.net> schrieb im Newsbeitrag news:HmaEi.14268$5x2.9193(a)trndny07... > Herbert Kleebauer wrote: > > ... > > gver.com>gver.exe > > del gever.com > > Funny thing is, with this typo, you've given 'em a clue. They're gonna > figure it out! Mmmmm, maybe not... (I thought I was disassembling data, > too :) > > Best, > Frank
From: Wolfgang Kern on 7 Sep 2007 18:52 "hutch--" <hutch(a)movsd.com> schrieb im Newsbeitrag news:1189176505.051015.262510(a)o80g2000hse.googlegroups.com... > Wannabee, > > > You really are scary stupid, Hutch-- > > Just shuddup and keep chewin. >
From: Wolfgang Kern on 7 Sep 2007 18:53 "hutch--" <hutch(a)movsd.com> schrieb im Newsbeitrag news:1189176505.051015.262510(a)o80g2000hse.googlegroups.com... > Wannabee, > > > You really are scary stupid, Hutch-- > > Just shuddup and keep chewin. >
From: //o//annabee on 7 Sep 2007 21:18
P� Fri, 07 Sep 2007 20:52:45 +0100, skrev Jim Carlock <anonymous(a)127.0.0.1>: > What happens if you... > > (1) Right-click upon cmd.exe, and select copy from the menu. > (2) Use Explorer to navigate to a temporary folder, then right- > click once again, but select paste. > (3) Change the name of the newly created cmd.exe to tmp_cmd.exe. > (4) Right-click upon that file and click on "Properties". > (5) Click upon the "Compatibility" tab. > (6) Set it to run as Windows 95 compatibility. > (7) Save the changes and then run your batch file inside of that > tmp_cmd.exe prompt. > Sound useful. Yes, But this is under XP right? |