File: tiny.notes

package info (click to toggle)
yara 4.5.4-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 13,820 kB
  • sloc: ansic: 52,244; yacc: 2,873; lex: 2,019; cpp: 863; makefile: 479; javascript: 85; sh: 47; python: 35
file content (22 lines) | stat: -rw-r--r-- 804 bytes parent folder | download | duplicates (8)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
tiny.exe was compiled from a simple oneliner,

    int main() { return 42; }

    $ i686-w64-mingw32-gcc -s -Wl,--file-alignment=4096 -o tiny.exe tiny.c

To demonstrate issue #429, two patched executables have been generated
where the PointerToRawData for the .idata section (offset 0x22c) was
changed from 0x5000 to 0x51ff (tiny-idata-51ff.exe) and 0x5200
(tiny-idata-5200.exe), respectively. While tiny-idata-51ff.exe can be
executed in Windows XP, tiny-idata-5200.exe can not.



Compiler version used to produce tiny.exe:

$ i686-w64-mingw32-gcc --version
i686-w64-mingw32-gcc (GCC) 5.3.1 20160205
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.