PE structure: Make the smallest executable
Recently I faced a problem in my devs. I needed an executable that does nothing, but the smallest as possible (to include it in a shellcode). Here’s the C++ code:
int WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
I followed this tutorial to reduce the size of the PE : http://thelegendofrandom.com/blog/archives/2231
And it led to a tiny PE (1kb). But not enough for me.
Then I followed this tutorial : http://win32assembly.programminghorizon.com/pe-tut1.html
and took this reference poster : http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf
Updated here: http://blog.dkbza.org/2012/08/pe-file-format-graphs.html
I removed lots of null bytes, and modified the parameters to adjust both size and section offset. To finish, I’ve loaded the PE into OllyDbg and modified the Entry point (which was not at the good place).