Back to home page

DOS ain't dead

Forum index page

Log in | Register

Back to the forum
Board view  Mix view

pestub + large stub = invalid executable for WinXP (DOSX)

posted by grompe(R) Homepage, Russia, 28.04.2008, 11:44


I noticed that pestub makes executables invalid for Windows XP, if it was
used to attach too large stub and size of PE header greater grew larger
than 4096 bytes. Trying different command line options didn't help.

It's not because of "stupid Windows XP" that I read somewhere (I don't
remember where, can't find it again), but because it's logical that PE
sections must not overlap, and PE header itself is considered a section.
Of course, PE header must be mapped into address space.

So, here are methods to solve this problem:

1. Use the following scheme:

[ MZ header ][ PE header ][ DOS data ][ Windows data ]

In this scheme, PE header wouldn't be larger than 4096 bytes unless there
are enormous number of sections in it.

I tried to move PE header this way after processing an executable with
pestub, t ran in Windows after that, but DOS executable failed. It was
HDLD32.BIN saying "memory shrink Error". In MZ header I changed only
"paragraphs in header" value. I tried to play with "minimum memory" and
"maximum memory", but didn't get any results. What I missed here?

2. Relocate an executable to fit DOS stub.

If relocations are present, we can relocate the sections so first section
start at bigger virtual address and fit whole DOS stub.

3. Reduce executable's image base to fit DOS stub.

If there are no relocations, we can reduce image base by needed space
size and fit DOS stub again. That would work for cases when we deliberately
increased image base to, say, 410000h when compiling the executable.

Maybe that's not very good idea and useless method, because when we can
compile, we always can insert relocation data (?).


Complete thread:

Back to the forum
Board view  Mix view
15297 Postings in 1378 Threads, 254 registered users, 14 users online (0 registered, 14 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum