Back to home page

DOS ain't dead

Forum index page

Log in | Register

Search:  
Back to the forum
Board view  Mix view

JPE and UPET improvements (Announce)

posted by DOS386, 27.01.2010, 13:08

> PE v1.17 fixes the infamous bug found by DOS386. Also adds a few
> new options concerning codeview symbolic debugging info.
COOL, the import bug seems fixed. But there is 1 bug left (see below) :-|

I'm now using JPE when referring to Japheth's tool and UPET as a preliminary name for mine :-)

My tool also got spectacular improvements:

[image]

- More rigid stub parsing and new errors supported (see ^^^ shot)

- The "Machine" is now getting decrypted (see ^^^ shot, and this field is inherently faulty again, it says "80386" even for the MPLAYER from 2009-12 using CMOVNTQ :-( )

- More validity checks in PE structures (see ^^^ shot, incredible how many bugs one can have in a "Hello World" program :clap: BTW, it is supposed (as author boasts ...) to work in NT but for me it securely fails in both ME and XP :clap: )

[image]

- The directory listing is heavily superior to JPE (see ^^^ shot), and the next victim of my rigid validity checks is the [in]famous NTVDM.EXE ... check the invalid entry at index 11 :clap:

[image]

- PX Sigi is of course also recognized, but the evil thing is the corrupt relox entry in the sectional header of your "PED.EXE" (see ^^^ shot, your BUG :-( ... also IDECHECK is affected by this)

[image]

- NE files (obsolete as hell) are also recognized (but not yet supported, see ^^^ shot)

[image]

- Also DGJPP files are recognized, of course no bad /STUBSIZE hack is required (see ^^^ shot)

[image]

- And LX (see ^^^ shot) ;-)

[image]

- Not even PE64 (see ^^^ shot) can break it :clap:


Opening file: "ntoskrnl.exe "
GetFileSizeEx: 2'189'184 = $0021'6780
Reading .... Done !

MZ Sigi: "MZ. "
MZ stub Size  : $0000'0490
MZ header Size: $0000'0040

--------------------------------
                            .
.... ...!..L.!This program canno
t be run in DOS mode....$
.<i.J]..J]..J]...RZ.M]..J]...]..
--------------------------------

Next Level Sigi (PE) position: $0000'00D8
Next Level Sigi: "PE  " recognized as PE
Follow Up Sigi : "    " (invalid)
ERROR: Stub size <> Next Level position
CRITICAL ERROR: Macro$oft linker detected
CRITICAL ERROR: Stub ''hint'' is faulty

Machine: $0000'014C - I80386 (believe with care)
Number of sexions: 21
Size of Optional Header: $0000'00E0
Characterum: $0000'010E
Baseball address : $0040'0000
Memory alignment : $0000'0080
File alignment   : $0000'0080
Image size       : $0021'6780
Submarine system : 1 - Ring0 driver :-)
Directory entries: $0000'0010 (content see below sections)

Sections:

no ---name--- exact-size rva-indeed file-posit attributes

00 ".text   " $0007'2511 $0000'0580 $0000'0580 $6800'0020
01 "POOLMI  " $0000'12B3 $0007'2B00 $0007'2B00 $6800'0020
02 "MISYSPTE" $0000'0700 $0007'3E00 $0007'3E00 $6800'0020
03 "POOLCODE" $0000'15A0 $0007'4500 $0007'4500 $6800'0020
04 ".data   " $0001'6DA0 $0007'5B00 $0007'5B00 $C800'0040
05 "PAGE    " $000F'A0CC $0008'C900 $0008'C900 $6000'0020
06 "PAGELK  " $0000'E3B9 $0018'6A00 $0018'6A00 $6000'0020
07 "PAGEVRFY" $0000'F1CD $0019'4E00 $0019'4E00 $6000'0020
08 "PAGEWMI " $0000'17E0 $001A'4000 $001A'4000 $6000'0020
09 "PAGEKD  " $0000'4052 $001A'5800 $001A'5800 $6000'0020
10 "PAGESPEC" $0000'0C43 $001A'9880 $001A'9880 $6000'0020
11 "PAGEHDLS" $0000'1DD8 $001A'A500 $001A'A500 $6000'0020
12 ".edata  " $0000'B5A2 $001A'C300 $001A'C300 $4000'0040
13 "PAGEDATA" $0000'1558 $001B'7900 $001B'7900 $C000'0040
14 "PAGEKD  " $0000'C021 $001B'8E80 $001B'8E80 $C000'0040
15 "PAGECONS" $0000'018C $001C'4F00 $001C'4F00 $C000'0040
16 "PAGEVRFC" $0000'3449 $001C'5100 $001C'5100 $4000'0040
17 "PAGEVRFD" $0000'0648 $001C'8580 $001C'8580 $C000'0040
18 "INIT    " $0002'D938 $001C'8C00 $001C'8C00 $E200'0020
19 ".rsrc   " $0001'0708 $001F'6580 $001F'6580 $4000'0040
20 ".reloc  " $0000'FA5C $0020'6D00 $0020'6D00 $4200'0040

PE Directory block: size = $80 Byte's, file position = $0000'0150

Entries (target: RVA, size, file position) :

00 Export $001A'C300, $0000'B5A2, $001A'C300 in sexion 12 (exact)
01 Import $001F'5C34, $0000'0050, $001F'5C34 in sexion 18 (inexact)
02 Resour $001F'6580, $0001'0708, $001F'6580 in sexion 19 (exact)
03 Excep? (unused)
04 Secur? (unused)
05 Relox  $0020'6D00, $0000'FA5C, $0020'6D00 in sexion 20 (exact)
06 Debug  $0007'2A30, $0000'0038, $0007'2A30 in sexion 00 (inexact)
07 CopRig (unused)
08 MipGP? (unused)
09 Tls?   (unused)
10 LConf? $0005'3828, $0000'0040, $0005'3828 in sexion 00 (inexact)
11 BouIm? (unused)
12 IAT    $0000'0580, $0000'0154, $0000'0580 in sexion 00 (exact)
13 ?????? (unused)
14 ?????? (unused)
15 ?????? (unused)

Export block found and valid
RVA, size, file position: $001A'C300, $0000'B5A2, $001A'C300

DLL name RVA: $001A'FD3E , string: "ntoskrnl.exe"
Amount of named exports: 1'487 = $0000'05CF

0 "CcCanIWrite"


- Fortunately it crashes in processing the export details, otherwise this post would be further 6'000 lines bigger :clap:

---
This is a LOGITECH mouse driver, but some software expect here
the following string:*** This is Copyright 1983 Microsoft ***

Post reply
 

Complete thread:

Back to the forum
Board view  Mix view
22632 Postings in 2109 Threads, 402 registered users, 396 users online (0 registered, 396 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum