Created
June 13, 2019 06:33
-
-
Save insolor/fc4f0c7f3e1f463d6b104934ca4e4ae8 to your computer and use it in GitHub Desktop.
Tiny PE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
format binary as 'exe' | |
IMAGE_DOS_SIGNATURE equ 5A4Dh | |
IMAGE_NT_SIGNATURE equ 00004550h | |
PROCESSOR_AMD_X8664 equ 8664h | |
IMAGE_SCN_CNT_CODE equ 00000020h | |
IMAGE_SCN_MEM_READ equ 40000000h | |
IMAGE_SCN_MEM_WRITE equ 80000000h | |
IMAGE_SCN_CNT_INITIALIZED_DATA equ 00000040h | |
IMAGE_SUBSYSTEM_WINDOWS_GUI equ 2 | |
IMAGE_NT_OPTIONAL_HDR64_MAGIC equ 20Bh | |
IMAGE_FILE_RELOCS_STRIPPED equ 1 | |
IMAGE_FILE_EXECUTABLE_IMAGE equ 2 | |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE equ 8000h | |
include 'win64a.inc' | |
org 0 | |
use64 | |
IMAGE_BASE = 400000h | |
Signature: dw IMAGE_DOS_SIGNATURE,0 | |
ntHeader dd IMAGE_NT_SIGNATURE;'PE' | |
;image_header-------------------------- | |
.Machine dw PROCESSOR_AMD_X8664 | |
.Count_of_section dw 1;2 | |
.TimeStump dd 0 | |
.Symbol_table_offset dd 0;ntHeader | |
.Symbol_table_count dd 0 | |
.Size_of_optional_header dw section_table-optional_header | |
.Characteristics dw 0x20 or IMAGE_FILE_RELOCS_STRIPPED or\ | |
IMAGE_FILE_EXECUTABLE_IMAGE | |
;20h Handle >2Gb addresses | |
;------------------------------------- | |
optional_header: | |
.Magic_optional_header dw IMAGE_NT_OPTIONAL_HDR64_MAGIC | |
.Linker_version_major_and_minor dw 9 | |
.Size_of_code dd 0 | |
.Size_of_init_data dd 0;xC0 | |
.Size_of_uninit_data dd 0 | |
.entry_point dd EntryPoint | |
.base_of_code dd ntHeader | |
.image_base dq IMAGE_BASE | |
.section_alignment dd 4 | |
.file_alignment dd 4 | |
.OS_version_major_minor dw 5,2 | |
.image_version_major_minor dd 0 | |
.subsystem_version_major_minor dw 5,2 | |
.Win32_version dd 0 | |
.size_of_image dd end_import | |
.size_of_header dd section_table | |
.checksum dd 0 | |
.subsystem dw IMAGE_SUBSYSTEM_WINDOWS_GUI | |
.DLL_flag dw IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE | |
.Stack_allocation dq 0x100000 | |
.Stack_commit dq 0x1000 | |
.Heap_allocation dq 0x100000 | |
.Heap_commit dq 0x1000 | |
.loader_flag dd 0 | |
.number_of_dirs dd (section_table-export_RVA_size)/8 | |
export_RVA_size dq 0 | |
.import_RVA dd import_ | |
.import_size dd end_import-import_ | |
;------------------------------------------------ | |
section_table: | |
.name dq '.text' | |
.virtual_size dd end_import-EntryPoint | |
.virtual_address dd EntryPoint | |
.Physical_size dd end_import-EntryPoint | |
.Physical_offset dd EntryPoint | |
.Relocations_and_Linenumbers dq 0 | |
.Relocations_and_Linenumbers_count dd 0 | |
.Attributes dd IMAGE_SCN_MEM_WRITE or IMAGE_SCN_CNT_CODE or IMAGE_SCN_MEM_READ or IMAGE_SCN_CNT_INITIALIZED_DATA | |
;--------данные, код и импорт----------------------------------------- | |
EntryPoint: | |
enter 20h,0 ; space for 4 arguments + 16byte aligned stack | |
xor ecx, ecx ; 1. argument: rcx = hWnd = NULL | |
mov r9, rcx ; 4. argument: r9d = uType = MB_OK = 0 | |
mov edx,section_table+IMAGE_BASE ; 2. argument: edx = window text | |
mov r8,rdx ; 3. argument: r8 = caption | |
call [MessageBox] | |
leave | |
ret | |
Import_Table: | |
user32_table: | |
MessageBox dq _MessageBox | |
import_: | |
dd 0,0,0,user32_dll,user32_table | |
dd 0 | |
user32_dll db "user32",0,0 | |
dw 0 | |
_MessageBox db 0,0,"MessageBoxA" | |
end_import: | |
;times 268-end_import db 0 ;filling up to 268 bytes | |
EndOfImage: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment