1,089 questions
0
votes
0
answers
157
views
How to generate an executable file in the Portable Executable file format?
Dear Fellow Developers,
I am interested in learning how the Portable Executable format works. So far, I have written files in the com-format, which are executable in DosBox. However, I would like to ...
1
vote
1
answer
82
views
Custom x64 Windows PE Not Running
I was trying to manually craft my own windows pe and for some reason cant seem to find out why my program isnt running, ive crossed checked all my alignments, file alignments, section alignments and ...
- 71
6
votes
0
answers
293
views
Local static variables are not initialized if app is loaded as dll
We have sandbox.exe, app.exe and app.dll. If users want to run the not sandboxed application, they run app.exe. If users want to run the application in the sandbox, they run sandbox.exe that loads app....
- 44.3k
2
votes
0
answers
101
views
Control-flow obfuscation without increasing code size? [closed]
I'm developing a PE executable packer and want to implement some form of lightweight, simple control-flow obfuscation that doesn't add any extra bytes to the original exe's .text section (i.e. no ...
- 2,271
0
votes
1
answer
66
views
How can I pad the bytes in a section defined by a pragma directive?
So I have these two macros
#define ESTART \
_Pragma("optimize(\"\", off)") \
_Pragma("section(\".secure\", execute, read, write)") \
_Pragma("...
- 7
0
votes
2
answers
115
views
winapi WriteFileA crashes the program in assembly (nasm)
(I'm on Windows 11) CreateFileA is crashing, but I have no clue why. I know that CreateFileA is crashing because the program doesn't loop at "wat: jmp wat"; instead it stops immediately. I ...
- 83
4
votes
1
answer
101
views
NASM assembly PE format handwritten imports doesn't import anything
This PE format .EXE program should print "owwwmagawd" in cmd when run, but instead the program hangs without printing anything. I figured there could be a problem with Windows not filling ...
- 83
2
votes
2
answers
179
views
Replace-Files Powershell
I'm having some struggles with my PowerShell script. I am trying to make an Automated Script that will Perform the Utilman.exe Hack. The script has menus and options: Load, Unload, List Disk and ...
- 21
0
votes
0
answers
149
views
GetProcAddress always returning 0x00000000 after changing the DllBase in the PEB
I'm trying to understand why I'm getting nothing from GetProcAddress().
I have been learning to build my own protected executable. I load a copy of ntdll.dll and map it into memory and then read the ...
- 21
2
votes
1
answer
354
views
x64 Reflective DLL Injector (translate C++ to Delphi)
I need an x64 Reflective DLL Injector written in Delphi.
I found a C version that works fine (compiled with DevC++ with 64bit app support). I made a Delphi version that compiles fine and without any ...
- 316
0
votes
1
answer
104
views
How to find .text section in PE file without PE headers
This is my code to get text section
section get_text_section(std::uintptr_t module)
{
section text_section = {};
PIMAGE_DOS_HEADER dosheader = reinterpret_cast<...
- 7
1
vote
0
answers
35
views
Why don't I get the correct function RVA from the PE export table in my loader code?
I'm writing a minimal PE loader that parses the export table to locate functions by name, in my hypervisor. However, when I try to retrieve the RVA of a function, the value seems incorrect. Here's the ...
0
votes
2
answers
138
views
How can I inject user-specific data (like a public key) into a pre-built Go binary without needing Go installed?
I am working on a Go application that encrypts sensitive files using a public key. The goal of my project is to create a customizable encryption tool that allows users to generate an executable ...
- 57
3
votes
1
answer
90
views
Read variable value from PE file
I got following C code compiled with GCC on Windows
#include <stdio.h>
#include <conio.h>
int main() {
int a = 68639977;
printf("int: %d", a);
getch();
a++;
...
- 43
1
vote
1
answer
152
views
What is `PhysicalAddress` used for in `IMAGE_SECTION_HEADER`?
PhysicalAddress is a member of the Misc union, defined as follows:
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
...
- 35