Skip to content

Instantly share code, notes, and snippets.

@insolor
Created June 13, 2019 06:33
Show Gist options
  • Save insolor/fc4f0c7f3e1f463d6b104934ca4e4ae8 to your computer and use it in GitHub Desktop.
Save insolor/fc4f0c7f3e1f463d6b104934ca4e4ae8 to your computer and use it in GitHub Desktop.
Tiny PE
format binary as 'exe'
IMAGE_DOS_SIGNATURE equ 5A4Dh
IMAGE_NT_SIGNATURE equ 00004550h
PROCESSOR_AMD_X8664 equ 8664h
IMAGE_SCN_CNT_CODE equ 00000020h
IMAGE_SCN_MEM_READ equ 40000000h
IMAGE_SCN_MEM_WRITE equ 80000000h
IMAGE_SCN_CNT_INITIALIZED_DATA equ 00000040h
IMAGE_SUBSYSTEM_WINDOWS_GUI equ 2
IMAGE_NT_OPTIONAL_HDR64_MAGIC equ 20Bh
IMAGE_FILE_RELOCS_STRIPPED equ 1
IMAGE_FILE_EXECUTABLE_IMAGE equ 2
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE equ 8000h
include 'win64a.inc'
org 0
use64
IMAGE_BASE = 400000h
Signature: dw IMAGE_DOS_SIGNATURE,0
ntHeader dd IMAGE_NT_SIGNATURE;'PE'
;image_header--------------------------
.Machine dw PROCESSOR_AMD_X8664
.Count_of_section dw 1;2
.TimeStump dd 0
.Symbol_table_offset dd 0;ntHeader
.Symbol_table_count dd 0
.Size_of_optional_header dw section_table-optional_header
.Characteristics dw 0x20 or IMAGE_FILE_RELOCS_STRIPPED or\
IMAGE_FILE_EXECUTABLE_IMAGE
;20h Handle >2Gb addresses
;-------------------------------------
optional_header:
.Magic_optional_header dw IMAGE_NT_OPTIONAL_HDR64_MAGIC
.Linker_version_major_and_minor dw 9
.Size_of_code dd 0
.Size_of_init_data dd 0;xC0
.Size_of_uninit_data dd 0
.entry_point dd EntryPoint
.base_of_code dd ntHeader
.image_base dq IMAGE_BASE
.section_alignment dd 4
.file_alignment dd 4
.OS_version_major_minor dw 5,2
.image_version_major_minor dd 0
.subsystem_version_major_minor dw 5,2
.Win32_version dd 0
.size_of_image dd end_import
.size_of_header dd section_table
.checksum dd 0
.subsystem dw IMAGE_SUBSYSTEM_WINDOWS_GUI
.DLL_flag dw IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
.Stack_allocation dq 0x100000
.Stack_commit dq 0x1000
.Heap_allocation dq 0x100000
.Heap_commit dq 0x1000
.loader_flag dd 0
.number_of_dirs dd (section_table-export_RVA_size)/8
export_RVA_size dq 0
.import_RVA dd import_
.import_size dd end_import-import_
;------------------------------------------------
section_table:
.name dq '.text'
.virtual_size dd end_import-EntryPoint
.virtual_address dd EntryPoint
.Physical_size dd end_import-EntryPoint
.Physical_offset dd EntryPoint
.Relocations_and_Linenumbers dq 0
.Relocations_and_Linenumbers_count dd 0
.Attributes dd IMAGE_SCN_MEM_WRITE or IMAGE_SCN_CNT_CODE or IMAGE_SCN_MEM_READ or IMAGE_SCN_CNT_INITIALIZED_DATA
;--------данные, код и импорт-----------------------------------------
EntryPoint:
enter 20h,0 ; space for 4 arguments + 16byte aligned stack
xor ecx, ecx ; 1. argument: rcx = hWnd = NULL
mov r9, rcx ; 4. argument: r9d = uType = MB_OK = 0
mov edx,section_table+IMAGE_BASE ; 2. argument: edx = window text
mov r8,rdx ; 3. argument: r8 = caption
call [MessageBox]
leave
ret
Import_Table:
user32_table:
MessageBox dq _MessageBox
import_:
dd 0,0,0,user32_dll,user32_table
dd 0
user32_dll db "user32",0,0
dw 0
_MessageBox db 0,0,"MessageBoxA"
end_import:
;times 268-end_import db 0 ;filling up to 268 bytes
EndOfImage:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment