Author Topic: Looking for the smallest possible .EXE  (Read 846 times)

Siekmanski

  • Member
  • *****
  • Posts: 1110
Re: Looking for the smallest possible .EXE
« Reply #30 on: October 20, 2017, 10:15:09 AM »
This one is also very good, but even harder to listen to than the previous guy.  :biggrin:
https://www.youtube.com/watch?v=3duSgr5b1yc

aw27

  • Member
  • ****
  • Posts: 785

hutch--

  • Administrator
  • Member
  • ******
  • Posts: 4873
  • Mnemonic Driven API Grinder
    • The MASM32 SDK
Re: Looking for the smallest possible .EXE
« Reply #32 on: October 21, 2017, 04:00:55 AM »
Thanks Jose, this is a good read in this format.
hutch at movsd dot com
http://www.masm32.com    :biggrin:  :biggrin:

aw27

  • Member
  • ****
  • Posts: 785
Re: Looking for the smallest possible .EXE
« Reply #33 on: October 21, 2017, 05:22:47 AM »
Thanks Jose, this is a good read in this format.
YVW, Hutch

Siekmanski

  • Member
  • *****
  • Posts: 1110
Re: Looking for the smallest possible .EXE
« Reply #34 on: October 21, 2017, 05:40:49 AM »
Thanks Jose.

Mikl__

  • Member
  • ****
  • Posts: 549
Re: Looking for the smallest possible .EXE
« Reply #35 on: October 21, 2017, 10:35:52 AM »
Thanks, Jose!

aw27

  • Member
  • ****
  • Posts: 785
Re: Looking for the smallest possible .EXE
« Reply #36 on: October 21, 2017, 10:37:37 PM »
YVW, Siekmanski and Mikl__

Mikl__

  • Member
  • ****
  • Posts: 549
Re: Looking for the smallest possible .EXE
« Reply #37 on: October 22, 2017, 01:37:30 AM »
Hi, aw27!
I understand English bad, but the google-translator suggested that "YVW" means "You're Very Welcome" - "don't thank us". aw27, you are very modesty!

LiaoMi

  • Member
  • **
  • Posts: 155
Re: Looking for the smallest possible .EXE
« Reply #38 on: October 22, 2017, 02:26:08 AM »
Hi Amigos :P,

how can I describe the import table, for example, for a MessageBoxA, with the technique of binary output it probably will not work, in this case, we need a builder?

Mikl__

  • Member
  • ****
  • Posts: 549
Re: Looking for the smallest possible .EXE
« Reply #39 on: October 22, 2017, 02:35:18 AM »
¡Hola amigo LiaoMi!
MessageBox for 64-bits Windows or 32-bits Windows? FASM x64
Code: [Select]
format binary as 'exe'
include 'win64a.inc'

struc dbs [data]
{
  common
  . db data
  .size = $ - .
}

IMAGE_DOS_SIGNATURE equ 5A4Dh               ;'MZ'
IMAGE_NT_SIGNATURE equ 00004550h        ;'PE',0,0
PROCESSOR_AMD_X8664 equ 8664h
IMAGE_SCN_CNT_CODE equ 00000020h
IMAGE_SCN_MEM_WRITE equ 80000000h
IMAGE_SCN_MEM_READ equ 40000000h
IMAGE_SCN_CNT_INITIALIZED_DATA equ 00000040h
IMAGE_SUBSYSTEM_WINDOWS_GUI equ 2
IMAGE_NT_OPTIONAL_HDR64_MAGIC equ 20Bh
IMAGE_FILE_RELOCS_STRIPPED equ 1
IMAGE_FILE_EXECUTABLE_IMAGE equ 2
IMAGE_BASE equ 0x400000
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE equ 8000h
use64
org 0
;--------DOS-stub-------------------------------
Signature dw IMAGE_DOS_SIGNATURE,0
;-------PE-header--------------------------------------------------
ntHeader dd IMAGE_NT_SIGNATURE;'PE'
;image_header----
Machine dw PROCESSOR_AMD_X8664;CPU Type
Count_of_section dw 0;Number of sections
TimeStump dd 0;Information about the time when the PE-file was compiled
Symbol_table_offset dd 0;A pointer to the size of debug information
Symbol_table_count dd 0;A pointer to the COFF symbol table-PE-format
Size_of_optional_header dw begin-optional_header;The size of optional header
Characteristics dw IMAGE_FILE_RELOCS_STRIPPED or \
IMAGE_FILE_EXECUTABLE_IMAGE;file attributes
;-------Standard field NT
optional_header:
Magic_optional_header dw IMAGE_NT_OPTIONAL_HDR64_MAGIC;Status Display File
Linker_version_major_and_minor dw 9;Contain the linker version that created the file.
Size_of_code dd 0;The total size of the code sections
Size_of_init_data dd 0x70;The total size of initialized data
Size_of_uninit_data dd 0;The total size of the uninitialized data
entry_point dd start
base_of_code dd begin
;------Additional fields NT-----------------------------------------------
image_base dq IMAGE_BASE
section_alignment dd 4
file_alignment dd ntHeader
OS_version_major_minor dw 5,2
image_version_major_minor dd 0
subsystem_version_major_minor dw 5,2
Win32_version dd 0
size_of_image dd end_import
size_of_header dd begin
checksum dd 0
subsystem dw IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL_flag dw IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
Stack_allocation dq 0x100000
Stack_commit dq 0x1000
Heap_allocation dq 0x100000
Heap_commit dq 0x1000
loader_flag dd 0
number_of_dirs dd (begin-export_RVA_size)/8
export_RVA_size dq 0
import_RVA_size dd _import,end_import-import
;--------code and data-----------------------------------------
begin:
MsgBoxText dbs 'Win64 Assembly is Great!',0
MsgCaption db "Win64 Iczelion's lesson #2: MessageBox",0
start:
push rbp; <-- not sub rsp,28h
xor ecx,ecx
mov edx,MsgBoxText+IMAGE_BASE
lea r8d,[rdx+MsgBoxText.size]; <-- not mov r8d,offset MsgCaption
xor r9d,r9d; MB_OK
call [MessageBox]
pop rbp
retn
;---------import---------------------------------------
Import_Table:
user32_table:
MessageBox  dq _MessageBox
_import:
dd 0,0,0,user32_dll,user32_table,0
user32_dll db "user32",0,0 ;<-- not "user32.dll"
dw 0
_MessageBox db 0,0,"MessageBoxA"
end_import:

LiaoMi

  • Member
  • **
  • Posts: 155
Re: Looking for the smallest possible .EXE
« Reply #40 on: October 22, 2017, 03:12:07 AM »
¡Hola amigo LiaoMi!
MessageBox for 64-bits Windows or 32-bits Windows? FASM x64
Code: [Select]
format binary as 'exe'
include 'win64a.inc'

struc dbs [data]
{
  common
  . db data
  .size = $ - .
}

IMAGE_DOS_SIGNATURE equ 5A4Dh               ;'MZ'
IMAGE_NT_SIGNATURE equ 00004550h        ;'PE',0,0
PROCESSOR_AMD_X8664 equ 8664h
IMAGE_SCN_CNT_CODE equ 00000020h
IMAGE_SCN_MEM_WRITE equ 80000000h
IMAGE_SCN_MEM_READ equ 40000000h
IMAGE_SCN_CNT_INITIALIZED_DATA equ 00000040h
IMAGE_SUBSYSTEM_WINDOWS_GUI equ 2
IMAGE_NT_OPTIONAL_HDR64_MAGIC equ 20Bh
IMAGE_FILE_RELOCS_STRIPPED equ 1
IMAGE_FILE_EXECUTABLE_IMAGE equ 2
IMAGE_BASE equ 0x400000
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE equ 8000h
use64
org 0
;--------DOS-stub-------------------------------
Signature dw IMAGE_DOS_SIGNATURE,0
;-------PE-header--------------------------------------------------
ntHeader dd IMAGE_NT_SIGNATURE;'PE'
;image_header----
Machine dw PROCESSOR_AMD_X8664;CPU Type
Count_of_section dw 0;Number of sections
TimeStump dd 0;Information about the time when the PE-file was compiled
Symbol_table_offset dd 0;A pointer to the size of debug information
Symbol_table_count dd 0;A pointer to the COFF symbol table-PE-format
Size_of_optional_header dw begin-optional_header;The size of optional header
Characteristics dw IMAGE_FILE_RELOCS_STRIPPED or \
IMAGE_FILE_EXECUTABLE_IMAGE;file attributes
;-------Standard field NT
optional_header:
Magic_optional_header dw IMAGE_NT_OPTIONAL_HDR64_MAGIC;Status Display File
Linker_version_major_and_minor dw 9;Contain the linker version that created the file.
Size_of_code dd 0;The total size of the code sections
Size_of_init_data dd 0x70;The total size of initialized data
Size_of_uninit_data dd 0;The total size of the uninitialized data
entry_point dd start
base_of_code dd begin
;------Additional fields NT-----------------------------------------------
image_base dq IMAGE_BASE
section_alignment dd 4
file_alignment dd ntHeader
OS_version_major_minor dw 5,2
image_version_major_minor dd 0
subsystem_version_major_minor dw 5,2
Win32_version dd 0
size_of_image dd end_import
size_of_header dd begin
checksum dd 0
subsystem dw IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL_flag dw IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
Stack_allocation dq 0x100000
Stack_commit dq 0x1000
Heap_allocation dq 0x100000
Heap_commit dq 0x1000
loader_flag dd 0
number_of_dirs dd (begin-export_RVA_size)/8
export_RVA_size dq 0
import_RVA_size dd _import,end_import-import
;--------code and data-----------------------------------------
begin:
MsgBoxText dbs 'Win64 Assembly is Great!',0
MsgCaption db "Win64 Iczelion's lesson #2: MessageBox",0
start:
push rbp; <-- not sub rsp,28h
xor ecx,ecx
mov edx,MsgBoxText+IMAGE_BASE
lea r8d,[rdx+MsgBoxText.size]; <-- not mov r8d,offset MsgCaption
xor r9d,r9d; MB_OK
call [MessageBox]
pop rbp
retn
;---------import---------------------------------------
Import_Table:
user32_table:
MessageBox  dq _MessageBox
_import:
dd 0,0,0,user32_dll,user32_table,0
user32_dll db "user32",0,0 ;<-- not "user32.dll"
dw 0
_MessageBox db 0,0,"MessageBoxA"
end_import:

Hi Mikl,

Thanks! I did not use fasm, but I think there are built-in tools for compiling this code. I would like to do something similar for uasm or masm, how to make the import table for UASM programs? You need to specify that this is an import variable, like "_import:
dd 0,0,0,user32_dll,user32_table"  ::)

aw27

  • Member
  • ****
  • Posts: 785
Re: Looking for the smallest possible .EXE
« Reply #41 on: October 22, 2017, 06:42:27 AM »
Hi, aw27!
I understand English bad, but the google-translator suggested that "YVW" means "You're Very Welcome" -
When I played Poker online, it was common  to read in the chat:
nh
ty
yvw

 :biggrin:

aw27

  • Member
  • ****
  • Posts: 785
Re: Looking for the smallest possible .EXE
« Reply #42 on: October 22, 2017, 06:49:07 AM »
I would like to do something similar for uasm or masm, how to make the import table for UASM programs?

Have a look at this.

It is a modification of the sample for Win32_5.
I believe there is still something to fix, though.

LiaoMi

  • Member
  • **
  • Posts: 155
Re: Looking for the smallest possible .EXE
« Reply #43 on: October 22, 2017, 09:46:45 AM »
I would like to do something similar for uasm or masm, how to make the import table for UASM programs?

Have a look at this.

It is a modification of the sample for Win32_5.
I believe there is still something to fix, though.

Hi aw27,

cool! How could I miss this master post!  :t

Mikl__

  • Member
  • ****
  • Posts: 549
Re: Looking for the smallest possible .EXE
« Reply #44 on: October 22, 2017, 11:32:07 AM »
Hi, LiaoMi!
will look this post Import x64
Compilers FASM and NASM allow you to create pure binary files. ML64.exe and LINK.exe will add to the commands and data a standard PE-header and a standard export/ import/ resource/ exception/ security/ fixups/ debug/ description/ MIPS GP/ TLS/ Load config/ bound import/ import table/ delay import/ COM runtime/ reserved sections. Problems can be solved if you use older versions of compiler ml.exe and link.exe that allow you to create COM-files and independently write the owner PE-header and the owner import section as I did in the example above.
« Last Edit: October 22, 2017, 02:21:57 PM by Mikl__ »