Re: Editors

From: The Half A Wannabee ("The)
Date: 03/07/04 

Date: Sun, 7 Mar 2004 15:55:22 +0100

"The Half A Wannabee" <ShakainZulu_AT(Pink floyd - Obscured by clouds).com>
wrote in message news:404b36b9$1@news.broadpark.no...
>
> "R.Wieser" <rwieser-killthis-@xs4all.nl> wrote in message
> news:404b2cbb$0$564$e4fe514c@news.xs4all.nl...
> > The Half A Wannabee <ShakainZulu_AT(Pink floyd - Obscured by
clouds).com>
> > schreef in berichtnieuws 404b1117$1@news.broadpark.no...
> >
> > Hello "The Half A Wannabee"
> >
> > > "R.Wieser" <rwieser-killthis-@xs4all.nl> wrote in message
> > > news:404b0621$0$564$e4fe514c@news.xs4all.nl...
> > > > Roy Jones <mhca12@sbcglobal.net> schreef in berichtnieuws
> > > > opr4gqxlnqjw3stx@news.la.sbcglobal.net...
> > > > > On 06 Mar 2004 22:36:35 GMT, Betov <betov@free.fr> wrote:
> > >
> >
> > And there are your problems :
> > 1) There is a good reason why programs are made so they can be
relocated.
> > Just two programs that someone wants to have loaded, which (partially)
> > overlap, and *poof !*.
>
> Hmm. I thought the relocation was transparent to the program. Since the
> adress space in any case is virtual, the relocation should be transparent
?
> In my delphi apps I sometimes save event pointers (8 bytes) to files, and
> there has been no problems with that so far. But.. is what you are saying
> that it is a risky *poff* buisness to record virtual adresses ?
>
> > 2) You still have to store the (not-to-be-relocated) program into a
file,
> > and that file *can* be comprimized. Either by an overwriting virus, or
by
> a
> > virus that relocates itself, and will than load the part that it had
> > overwritten from the file to the correct spot.
>
> Are you saying the virus would do its thing, repair the exe and continue?

Of course a sort of worm could host in the exe and crawl. Thats what you're
saying ? But it cant spread in this exe? It must repair it. Each time the
exe runs it must be repaired first? I do not understand. Since the data
segment addresses are relative to the code size, it would be simply
impossible for the virus to remain in the exe while the exe is running. And
the exe could check itself. Also, each exe is diffrent so the virus must
know all of them. Remember that with this sheme, I can determine, at compile
time (with some care) where my data will be placed, and insert constant
pointers to the data for controll in the exe. Each exe with diffrent
controls pointers would make the virus work a real hell? The virus will
spread MUCH slower if such a sheme could be made to work ?

> >
> > Regards,
> > Rudy Wieser
> >
>
>
>
>

Relevant Pages

  • Re: how do you start learning assembly language
    ... But you really ought to have a dos stub - I ... the code doesn't load at its preferred address, ... .exe goes into memory first, it always loads at 400000h, and so doesn't ... need relocation. ...
    (alt.lang.asm)
  • Re: loadlibrary mfc exe
    ... I am trying to load MFC exe module as dynamic link library and call an ... The exe is loaded successfully and the function is entered, ... like a DLL. ... You can do the relocation yourself, but you will only end up hurting ...
    (microsoft.public.win32.programmer.kernel)
  • Re: [AMD64] How do I load and relocate a PE32+(AMD64) executable?
    ... about AMD's 64-bit extension. ... The image I built is an EXE and it doesn't use any OS ... The loader I wrote provides the necessary ... > If there's no relocation section, ...
    (microsoft.public.win32.programmer.kernel)
  • Re: registry? virus? help!
    ... I found it interesting that you mentioned Itunes. ... launch anti-virus software which returned no results that indicate a virus. ... then whenever i open any .EXE files, ... but i cant use any of them cuz they are all EXE files.. ...
    (microsoft.public.windowsxp.general)
  • RE: registry? virus? help!
    ... I found it interesting that you mentioned Itunes. ... launch anti-virus software which returned no results that indicate a virus. ... then whenever i open any .EXE files, ... but i cant use any of them cuz they are all EXE files.. ...
    (microsoft.public.windowsxp.general)