I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section and minor change to code section of the executable while maintaining the same checksum?
Not really changing the opcode, just inserting different input.Length
(length of null-terminated text string in data section)
push 0xfffffff5 // - 11
call DWORD PTR ds:0x40304c // .idata [GetStdHandle]
push 0x0
push 0x401014
push [input.Length]
push 0x401000 // .data
push eax
call DWORD PTR ds:0x403050 // .idata [WriteConsole]
push 0x0
call DWORD PTR ds:0x0403048 // .idata [ExitProcess]
Why does it still run even though I use different checksum? For example, it still run even if I change the checksum to 0x995A or 0x5A99.
I use ImageHlp.dll
to compute the checksum as summarized below:
int HeaderSum = 0;
int CheckSum = 0;
IntPtr ptrHeaderSum=Marshal.AllocHGlobal(sizeof(int));
Marshal.WriteInt32(ptrHeaderSum, HeaderSum);
IntPtr ptrCheckSum = Marshal.AllocHGlobal(sizeof(int));
Marshal.WriteInt32(ptrCheckSum, CheckSum);
UInt32 status= ImageHlp.MapFileAndCheckSumA(@"D:\19_02_21.exe", ptrHeaderSum, ptrCheckSum);
Console.WriteLine(status);
CheckSum = Marshal.ReadInt32(ptrCheckSum);
Console.WriteLine(CheckSum);
Marshal.FreeHGlobal(ptrHeaderSum);
Marshal.FreeHGlobal(ptrCheckSum);
Console.ReadLine();