volodya
November 22nd, 2003, 18:23
You think you are a PE hero?
Hm, cuPegasus. There are many MUCH more difficult things than this one.
A default PE file (lets assume a dialog application created with asm) contains NO IAT AND ImportTable (creation is very simple using stack during startup). Both entrys in OptionalHeader.DataDirectory's are Zero, it's size is Zero too. Which named OS is able to run this application: Win9X, Win2K, WinXP? AND WHY?
1. I don't know such OS as Win 9x
2. Win 2k/Win XP/Win 2003.
Hopefully you know that PE file is checked TWO times. 1 one is when the OS creates the context of the process, i.e. the region of the virtual adresses. For Win2k the function is called MiVerifyImageHeader. The pseudocode is here:
NTSTATUS MiVerifyImageHeader(PIMAGE_NT_HEADERS pPE, ...)
{
DWORD FileAlign;
if(pPE->Signature != IMAGE_NT_SIGNATURE)
{
if(pPE->Signature != IMAGE_OS2_SIGNATURE)
return STATUS_INVALID_IMAGE_PROTECT; //0C0000130h
else
{
/*...code for NE-checking...*/
if (NE is invalid)
return STATUS_INVALID_IMAGE_WIN_16; //0C0000131
}
}
if (!pPE->FileHeader.Machine)
{
if(!pPE->FileHeader.SizeOfOptionalHeader)
return STATUS_INVALID_IMAGE_PROTECT;
}
//IMAGE_FILE_EXECUTABLE_IMAGE
if (!(pPE->FileHeader.Characteristics & 2))
return STATUS_INVALID_IMAGE_FORMAT; //0C000007Bh
if(!(pPE & 3))
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC)
return STATUS_INVALID_IMAGE_FORMAT;
FileAlign = pPE->OptionalHeader.FileAlignment;
if (!(FileAlign & 0x1FF))
{
if(FileAlign != pPE->OptionalHeader.SectionAlignment)
return STATUS_INVALID_IMAGE_FORMAT;
}
if (!FileAlign)
return STATUS_INVALID_IMAGE_FORMAT;
if (!(FileAlign & (FileAlign-1)))
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.SectionAlignment < FileAlign)
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.SizeOfImage > 0x77000000)
return STATUS_INVALID_IMAGE_FORMAT;
return
(pPE->FileHeader.NumberOfSections > 0x60) ?
(STATUS_INVALID_IMAGE_FORMAT)
0);
}
There are several more check in hyperspace... But I omit them for now
This was the FIRST time. Second time the PE is checked with ntdll.dll. There are several tricks here. At first, it is OS specific and Win2k WON'T LOAD the file without Bound imports and imports directory. If bound imports are present, no need in imports directory and loader safely ignores it. bound imports directory is outside of the PE file sections, it is located in pseudosection. If no bound imports are present and there is NO import directory - the file won't be loaded. For the XP situation is a little bit softer. I don't have this OS installed, so I cannot check it
But several people were telling me it is POSSIBLE to run such file under this OS.
Does this suticfy you, cuPegasus?
