Article View: comp.lang.asm.x86
Article #51Re: Absolute addresses, relative addresses
From: Eric Minso
Date: Tue, 26 Aug 2003 13:11
Date: Tue, 26 Aug 2003 13:11
30 lines
3249 bytes
3249 bytes
"Koms Bomb" <KomsBombREMOVETHIS@hotmail.com> wrote in message > Usual program won't use such style because it will make the program > more complex to read and maintain and slower when running. > Such style is very popular in virus world, because they can't be relocated > by the system. > > btw, Why do you hate absolute addresses? :-) Yes, the program I have to write really looks like a virus. I am a trainee in a IT company, and my training subject is to write an Windows EXE protection program. This program must encrypt the executable's code section and add a decryption routine inside the executable. The first approach I tried was to make a kind of winzip self-extractor. The main problem is that a temporary file is required : it is not a very secure solution :-( The other main problem is that it's always crashing :-((. The virus-like approach seems to be the most interesting (and easy) because the decryption job is done in memory and don't need a temporary file. There is also some common virus sources available on the internet, so a part of the job is already done :-) The main problem is that it seems that assembly language is required and I still have some troubles with absolute and relative addresses. The other main problem is that I fear my program will be seen as a virus by antiviruses.
Technical Details
Message-ID:
<7db38e60.0308260511.4b9a371@posting.google.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-03!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mailReferences:
<7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f7d8d,44f17f79ebe31523 X-Google-Attributes: gidf7d8d,public X-Google-Thread: 1093da,44f17f79ebe31523 X-Google-Attributes: gid1093da,public X-Google-Thread: feaef,44f17f79ebe31523 X-Google-Attributes: gidfeaef,public X-Google-Thread: 114917,44f17f79ebe31523 X-Google-Attributes: gid114917,public X-Google-ArrivalTime: 2003-08-26 10:56:15 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-03!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail From: minso@altern.org (Eric Minso) Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm Subject: Re: Absolute addresses, relative addresses Approved: CLAX86 Moderators <ccrayne@crayne.org> Date: 26 Aug 2003 06:11:12 -0700 Organization: http://groups.google.com/ Message-ID: <7db38e60.0308260511.4b9a371@posting.google.com> X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org X-CLAX86-Info-2: Send technical complaints to ccrayne@crayne.org X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org X-Comment: moderators do not necessarily agree or disagree with this article. References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-0.7, required 4, MAILTO_TO_REMOVE 0.30, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50) X-UIDL: Ka8"!-Kh!!np)!!WVQ!! X-Complaints-To: abuse@supernews.com Lines: 31