0

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.

Questions:

Does it matter if I make changes to the data section and minor change to code section of the executable while maintaining the same checksum?

Not really changing the opcode, just inserting different input.Length (length of null-terminated text string in data section)

     push 0xfffffff5 // - 11
     call DWORD PTR ds:0x40304c // .idata [GetStdHandle]
     push 0x0
     push 0x401014
     push [input.Length]
     push 0x401000 // .data
     push eax
     call DWORD PTR ds:0x403050 // .idata [WriteConsole]
     push 0x0
     call DWORD PTR ds:0x0403048 // .idata [ExitProcess]

Why does it still run even though I use different checksum? For example, it still run even if I change the checksum to 0x995A or 0x5A99.

I use ImageHlp.dll to compute the checksum as summarized below:

int HeaderSum = 0;
int CheckSum = 0;
IntPtr ptrHeaderSum=Marshal.AllocHGlobal(sizeof(int));
Marshal.WriteInt32(ptrHeaderSum, HeaderSum);
IntPtr ptrCheckSum = Marshal.AllocHGlobal(sizeof(int));
Marshal.WriteInt32(ptrCheckSum, CheckSum);
UInt32 status= ImageHlp.MapFileAndCheckSumA(@"D:\19_02_21.exe", ptrHeaderSum, ptrCheckSum);

Console.WriteLine(status);
CheckSum = Marshal.ReadInt32(ptrCheckSum);
Console.WriteLine(CheckSum);

Marshal.FreeHGlobal(ptrHeaderSum);
Marshal.FreeHGlobal(ptrCheckSum);
Console.ReadLine();

1 Answer 1

0

The PE checksum is only checked for drivers by the kernel, for the user-mode binaries it's optional. As mentioned in the doc:

Checksums are required for kernel-mode drivers and some system DLLs. The linker computes the original checksum at link time, if you use the appropriate linker switch. For more details, see your linker documentation.

The linker option is /RELEASE:

The /RELEASE option sets the Checksum in the header of an .exe file.

The operating system requires the Checksum for device drivers. Set the Checksum for release versions of your device drivers to ensure compatibility with future operating systems.

The /RELEASE option is set by default when the /SUBSYSTEM:NATIVE option is specified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.