Einzelnen Beitrag anzeigen

Kas Ob.

Registriert seit: 3. Sep 2023
223 Beiträge
 
#4

AW: NASM - Erstellung eines Win64-Bit Images für die Verwendung mit mehr als 2 Funcca

  Alt 29. Okt 2023, 17:33
I am really sorry, something went very wrong with translation and my brain understanding what is the question is.

I answered different thing as the translation gave me that you are building an DLL with NASM

Anyway, i looked and it seems you are putting the import directory iatbl in code section, this will be a problem as code section should be with execute memory protection and the import usually will only be read and write with no execution, that one also the size of the import table and thunk looks off, in fact the two sizes should be recalculated, for both code section and the extra '.' section, as for the import the indexes are off too.

Using one section is considered malicious and will not be allowed to run by any AntiVirus or security software, so when say you want flat image i understand it as you want one section with the PE header, i would suggest to to make sure there is two distinctive section that not overlapping like your code above, and make sure they are aligned (padded is not essential as the RVA size id right), only then you can build the import right.

You said it is working and showing a message with the alternative code, there is a chance that Windows resolved only one and filled it then stopped because the section is marked as execute allowed not read/wite.

Another thing: without ExitProcess explicitly called, that EXE will be raising exception on exit.
  Mit Zitat antworten Zitat