Click here to Skip to main content
15,889,527 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Dll Not Found Pin
JWood10-Jun-05 5:11
JWood10-Jun-05 5:11 
GeneralRe: Dll Not Found Pin
Alexander M.,10-Jun-05 5:15
Alexander M.,10-Jun-05 5:15 
GeneralRe: Dll Not Found Pin
Blake Miller10-Jun-05 5:50
Blake Miller10-Jun-05 5:50 
GeneralRe: Dll Not Found Pin
Toby Opferman10-Jun-05 6:16
Toby Opferman10-Jun-05 6:16 
GeneralRe: Dll Not Found Pin
Blake Miller10-Jun-05 6:29
Blake Miller10-Jun-05 6:29 
GeneralRe: Dll Not Found Pin
Toby Opferman10-Jun-05 8:02
Toby Opferman10-Jun-05 8:02 
GeneralRe: Dll Not Found Pin
ThatsAlok10-Jun-05 18:03
ThatsAlok10-Jun-05 18:03 
GeneralRe: Dll Not Found Pin
Toby Opferman10-Jun-05 18:47
Toby Opferman10-Jun-05 18:47 
You will be sorry that you asked Smile | :)

This is actually the machine code of a program I wrote a long time ago. This is whole program and it was basically in "TINY" .COM format. The .COM format is a raw binary format that contains no headers and only raw binary code and data. The .COM is limited to 64k of memory - sizeof PSP - your stack.

The PSP was the first 256 bytes of the segment and at offset 100h (256) your raw binary code would be loaded. This file format's elegance of having no header information made it a perfect candidate for "lowest bytes" competitions. If you used to do the very small ones you know that you would ask what rules would need to be applied to the competition, such as:

1. Can I print garbage?
2. Can I assume certain registry values?
3. Can I use x or y interrupt?
4. Can I use this or that trick?

So, in MS DOS you could assume certain values of registers on entry. These were:

DI = FFFEh
SI = 100h
AX = 0
BX = 0
CX = 00FFh

The binary code that is in my signature looks like this in 16 bit:

8BC7          MOV     AX,DI
C0EC02        SHR     AH, 2
C0E404        SHL     AH, 4
C0CC06        ROR     AH, 6
80F701        XOR     BH,01
8827          MOV     [BX],AH
EBEE          JMP     0100


"JMP 100" means jump back to the top of this program since 100h is the starting offset. So, without further evaluation of what this code is doing it looks like it's an infinite loop.

Let's examine what is going on though.

1. MOV AX, DI ; AX = DI = FFFEh
2. SHR AH, 2 ; AH = FF, AH>>2 = 6Fh
3. SHL AH, 4 ; AH = 6F, AH<<4 = F0h
4. ROR AH, 6 ; AH = F0, AH Rotate 6 = C3h
5. XOR BH, 1 ; BX = 0, BX = 100h
6. MOV [BX], AH ; BX = 100h, Ah = C3h, [100h] = C3h
7. Jmp to 100h (256)

So, what happens is that we take FFFEh into AX then we take the top half and do a few funny tricks just to confuse and eventually rotate the result into C3h.

Then what happens is the high byte of BX is set to 1 through the 0 xor 1 = 1 which makes BX = 256. We then move the value of AH into the memory location of 100h.

The final jump goes to 100h which now contains the value of C3h. You could say that if the cache isn't flushed it would contain the old value of MOV AX, DI however the JMP instruction should have flushed it.

In any case again we have another trick in that the Stack is said to be initialized to 0. C3h = RET instruction or Return which takes the address on the stack and jumps to that location. In this case, it's 0.

What's at 0? The PSP is at 0 and the first two bytes of the PSP is CD20 or "INT 20h" which was the original method of exiting a .COM application (preceeded by the .EXE method of INT 21h with function 4fh).

So that's it. The code is just self modifying code that does nothing but return.

On a side note, the extension of .COM and .EXE does not matter. The first two bytes of a .EXE (LE, NEHDR or PE format) are "MZ". The loader ignores ".COM" and ".EXE" and looks for these two bytes. If it finds them it attempts to load as a .EXE if not, then .COM. The only difference the .COM and .EXE extensions made was the loader looks for .COM first then .EXE. So if two applications named "x.com" and "x.exe" were in the same directory and you typed "x", "x.com" would be the only one executed. And it could even be in .EXE format!






8bc7c0ec02c0e404c0cc0680f7018827ebee
GeneralRe: Dll Not Found Pin
ThatsAlok10-Jun-05 19:11
ThatsAlok10-Jun-05 19:11 
GeneralRe: Dll Not Found Pin
Alexander M.,10-Jun-05 8:17
Alexander M.,10-Jun-05 8:17 
GeneralRe: Dll Not Found Pin
John R. Shaw10-Jun-05 22:06
John R. Shaw10-Jun-05 22:06 
GeneralAgain Problem Pin
Aqueel10-Jun-05 4:47
Aqueel10-Jun-05 4:47 
GeneralRe: Again Problem Pin
Chris Losinger10-Jun-05 4:50
professionalChris Losinger10-Jun-05 4:50 
GeneralRe: Again Problem Pin
ThatsAlok10-Jun-05 23:48
ThatsAlok10-Jun-05 23:48 
GeneralShared Folder... confused Pin
Roger Garrett10-Jun-05 4:41
Roger Garrett10-Jun-05 4:41 
GeneralRe: Shared Folder... confused Pin
David Crow10-Jun-05 6:14
David Crow10-Jun-05 6:14 
GeneralRe: Shared Folder... confused Pin
Roger Garrett10-Jun-05 6:49
Roger Garrett10-Jun-05 6:49 
GeneralRe: Shared Folder... confused Pin
Garth J Lancaster10-Jun-05 17:45
professionalGarth J Lancaster10-Jun-05 17:45 
GeneralInsane asserts Pin
benjymous10-Jun-05 4:31
benjymous10-Jun-05 4:31 
GeneralRe: Insane asserts Pin
Roger Garrett10-Jun-05 4:46
Roger Garrett10-Jun-05 4:46 
GeneralRe: Insane asserts Pin
benjymous10-Jun-05 5:02
benjymous10-Jun-05 5:02 
GeneralRe: Insane asserts Pin
Roger Garrett10-Jun-05 5:25
Roger Garrett10-Jun-05 5:25 
GeneralRe: Insane asserts Pin
JWood10-Jun-05 5:04
JWood10-Jun-05 5:04 
GeneralRe: Insane asserts Pin
BlackDice10-Jun-05 9:32
BlackDice10-Jun-05 9:32 
GeneralDisable or Enable a Button Pin
Hachaso10-Jun-05 3:51
Hachaso10-Jun-05 3:51 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.