With the recent upload of the smallest EXE, I wanted to try and replicate this with my own code.
The issue arises when I collapse the DOS header and skip to the PE header. Is there a set in stone way I can collapse the headers, and have the code execute at Entry? or are there other things I have to keep in mind?
I’m interested in understanding the key differences in the PE header structure that might be causing the issue.
As shown in his example:
BITS 64
;HEADER:
DW 'MZ'
DW 0
PE_HDR:
DW 'PE'
DW 0
...
ENTRY:
PUSH 0x100
POP RAX
RET
;TRAILING 0s
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DQ 0
DB 0
FILESIZE EQU $-$$
When I attempt the same thing, but add my own code to the Entry, the file is no longer recognized as a valid PE.
Full example:
BITS 64
;DOS Header:
dw 'MZ'
dw 0
pe_hdr:
dw 'PE'
dw 0
dw 0x8664
dw 0x01
dd 0
dd 0
dd 0
dw opt_hdr_size
dw 0x22
opt_hdr:
dw 0x020b
db "inkbox"
dd 0
dd 0
dd entry
dd 0
dd 0
dd 00
dd 4
dd 4
dw 0
dw 0
dw 0
dw 0
dw 0x06
dw 0
dd 0
dd file_size
dd 0
dd 0
dw 0x02
dw 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
opt_hdr_size equ $-opt_hdr
entry:
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
db 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xc2
file_size equ $-$$
Program '268.exe' failed to run: The specified executable is not a valid application for this OS
Is there a set in stone way I can collapse the headers, and have the code execute at Entry? or are there other things I have to keep in mind?
I have made sure the EXE is/more than 268 Bytes, I tried creating a jmp
to a code:
portion, and I have tried modifying the code to include trailing 0’s.
Any insight is very helpful. Thank you !
whoknows is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1