Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove fake plt/got in windows PE files #65

Open
gogo2464 opened this issue Oct 1, 2023 · 2 comments
Open

remove fake plt/got in windows PE files #65

gogo2464 opened this issue Oct 1, 2023 · 2 comments
Assignees
Labels
binary fails DDisasm fails to correctly disassemble a binary

Comments

@gogo2464
Copy link
Contributor

gogo2464 commented Oct 1, 2023

Using masm, we could frmove the fake plt/got in windows pe files. Let's just find and add some dependencies:

An example of masm32 output:

.model flat, stdcall
option casemap:none

      include \masm32\include\windows.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc

      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib

.code

start:
    call    CreateFileA

THis could be a good improvment. I need more experience specific to ddisam programming in order to specifically be assigned to this issue.

@gogo2464 gogo2464 added the binary fails DDisasm fails to correctly disassemble a binary label Oct 1, 2023
@aeflores
Copy link
Collaborator

aeflores commented Oct 5, 2023

I am not sure what you mean, PE programs don't have PLT or GOT sections, they have an import table (IAT). Are you thinking about removing the EXTERN declarations that we have in PE asm listings?

@gogo2464
Copy link
Contributor Author

gogo2464 commented Oct 5, 2023

I was thinking about the .text disassembled section that contains relocation yes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
binary fails DDisasm fails to correctly disassemble a binary
Projects
None yet
Development

No branches or pull requests

2 participants