*********************************************************** *********************; * The small portable executable format program information *; ******** *********************************************************** ************* * AUTHOR: NJHHACK E-mail: njhck@21cn.com Homepage: Hotsky.363.net *; * Created Date: 2001.5 .6 *; * west from Copyright (C) 1987, 1996 Borland International *; * Turbo Assembler Version 4.1: Tasm / m Spe *; * Turbo Link Version 7.1.30.1: Tlink / 3 / T SPE, SPE.exe ********************************************************* ***************************************
; ------------------- ; | DOS-STUB | 50H; ----------------- ; | File-header | - 18h; ----------------- |; Optional header | | 60H --------- - ; ------------------- - Total = 1C0H | --- Total 0E0H; | Data Directories | | 80H ----- ------ ; ------------------- |; section headers | - 28h -----> Total 0B8H; - ------------------ ; | Section 1 | .code section; ---------------- ; | Section 2 |; ------------------ ; | ... |; -------------- --- ; | section n |; -------------------
*********************************************************** ****; dos stub; *************************************************** *********** .286pDosHeader SEGMENT; BeginProgram: DosSignature db 'MZ'; LastSectorLength dw 1; FileSize dw 2; this size include head section, the unit is 512 bytes RelocateTableNums dw 0; HeadSize dw 2; This size unit is 16 BYTESMINMEM DW 0; MAXMEM DW 0FFFH; Offsetss DW 0; Offsetsp DW 0B8H; FileChecksum DW 0; Offsetip DW 0; OffsetCs DW 0; FistrelocateAddress DW 3EH; NOUsed in pev Erloaynums dw 0; ORG 20H;; ***************************************************** ***********; DOS PROC; ****************************************** ****************** MOV DX, OFFSET DOS_MESSAGE 100H-20H; MOV AH, 9; INT 21H; MOV AX, 4C01H; INT 21H; DOS_MESSAGE DB 'RUN WIN2000. ', 0DH, 0AH, 07,' $ '; org 3ch; pe sig peheadaddress db 50h; ORG 50H;
Dosheader Ends; ********************************************************************************************************************************************************************************************************************************************************************* ******; File header; ************************************************* **************** .586p FileHeader SEGMENT; WinSignature dd 4550h; PE FormatMachine dw 14ch; Intel 80386 NumberOfSections dw 1; .code SectionTimeDateStamp dd 0352068f1h; PointerToSymbolTable dd 0; unusedNumberOfSymbols dd 0; Unusedsizeofoptionalheader dw 0e0h; constant = optinal header data directorycharacteristics DW 010FH; Executable on 32-bit-machine; *********************************************************************************************************************** ******************; Optional Header; ************************** ************************************* MAGIC DW 010BH; Constantmajorlinkerversion DB 5 ; I'm version 0.0 :-) MinorLinkerVersion db 2; SizeOfCode dd 1000h; 32 bytes of code; 100hSizeOfInitializedData dd 0; yet to find out; 0SizeOfUninitializedData dd 0; we do not have a BSS; 0AddressOfEntryPoint dd 1000h; yet to find out; 1010hBaseOfCode dd 1000h; yet to find out; 1000hBaseOfData dd 2000h; yet to find out; 200hImageBase dd 400000h; 1 MB, chosen arbitrarily; 400000hSectionAlignment dd 1000h; 32-bytes-alignment; 100h; FileAlignment dd 20h; 200h; 32- BYTES-alignment; 200h;
MajorOperatingSystemVersion dw 4; NT 4.0MinorOperatingSystemVersion dw 0; MajorImageVersion dw 1; version 1.2MinorImageVersion dw 2; MajorSubsystemVersion dw 4; Win32 4.0MinorSubsystemVersion dw 0; Win32VersionValue dd 0; unused;? SizeOfImage dd 2000h; yet to find out; 200hSizeOfHeaders dd 200h; yet to find out; 200hCheckSum dd 0; not used for non-driversSubsystem dw 2; Win32 consoleDllCharacteristics dw 0; unused (not a DLL) SizeOfStackReserve dd 100000h; 1 MB stackSizeOfStackCommit dd 1000h; 4 KB to start withSizeOfHeapReserve dd 100000h; 1 MB heapSizeOfHeapCommit DD 1000h; 4 kb to start withloaderflags DD 0; UnknownNumberofrvaandsizes DD 10h; constant; *************************************************************** ********; Image Data Directories,; ****************************************** *************************** ********; Address SizeIde00Export DD 0, 0; Image_Directory_Entry_Export (0) IDE01IMPORT DD 0,0; image_directory_entry_import (1) IDE02Resource DD 0, 0; Image_Directory_ENTRY_RESOURCE (2) Ide03Exception DD 0, 0; Image_Directory_Entry_Exception (3) Ide04Security DD 0, 0;
IMAGE_DIRECTORY_ENTRY_SECURITY (4) Ide05BaseReloc dd 0,0; IMAGE_DIRECTORY_ENTRY_BASERELOC (5) Ide06Debug dd 0,0; IMAGE_DIRECTORY_ENTRY_DEBUG (6) Ide07Copyright dd 0,0; IMAGE_DIRECTORY_ENTRY_COPYRIGHT (7) Ide08Globalptr dd 0,0; IMAGE_DIRECTORY_ENTRY_GLOBALPTR (8) Ide09Tls dd 0,0; IMAGE_DIRECTORY_ENTRY_TLS (9) Ide10LoadConfig dd 0,0; IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG (10) Ide11BoundImport dd 0,0; IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (11) Ide12Iat dd 0,0; IMAGE_DIRECTORY_ENTRY_IAT (12) Ide13 dd 0,0; 13Ide14 dd 0,0; 14Ide15 dd 0, 0; 15; ************************************************************ ***************; section header; ********************* ***************************** **************************** SectionName DB '.code', 0,0,0; ". Code", 8 BYTESVIRTUALSIZE DD 1000h; unusedVirtualAddress dd 1000h; yet to find outSizeOfRawData dd 1000h; size of codePointerToRawData dd 200h; yet to find outPointerToRelocations dd 0; unusedPointerToLinenumbers dd 0; unusedNumberOfRelocations dw 0; unusedNumberOfLinenumbers dw 0; unusedCharacteristics2 dd 60000020h; code, executable, readable;
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------- DD Pesize; VersionCopyRight DB 'Win32.pe 1.0'; ORG 1B0H; FileHeader Ends; ********************** *********************************************************** **********; .code section; ****************************************** *************************************************************** CODESECTION segment; 1 RET; Pesize = $; CodeSecion Ends End BegInprogram
*********************************************************** ***************************; * NJHHACK 2001.5.6 CopyRigth (c) 2001-2004 Allrights reserved. *; * This pe file Is Only 513 Bytes, But It's A Raw Program, IT's Fun!; ******************************************** ************************************************
