Page 1 of 1

PE process creation error

Posted: Sun Mar 01, 2015 12:30 pm
by LPeter
Hi!
I've loaded a PE image into memory, and tried to execute it but failed. The entry point is found and is correct, but when I jump there it triple faults. I've looked at the PE file and at the entry point there are a bunch of zeros (and I have no idea why).
So the code I compiled:

Code: Select all

int main(void){
	char *msg = "Hello process!\n";
	__asm__ __volatile__(
		".intel_syntax noprefix\n"
		"mov ebx, %0;\n"
		"xor eax, eax;\n"
		"int 0x66;\n"
		".att_syntax\n"
		:
		: "r"(msg)
	     	: "eax", "ebx"
	);
	
	for(;;);
	return 0;
}
And I don't know what could be wrong (maybe I compiled wrong?). Here is the compiled thing:
https://www.mediafire.com/?xd6y7v31ux198y6

I'm not sure about the compiled file, I use linux and I compiled this on a windows laptop.

Does anyone have an idea what could be the problem?

Re: PE process creation error

Posted: Sun Mar 01, 2015 1:31 pm
by LPeter
Nevermind, it works (the problem was not the .exe). Now it works but it gets data from the wrong places.

Re: PE process creation error

Posted: Sun Mar 01, 2015 4:05 pm
by no92
Sorry for replying now, but I think you still might learn something.
LPeter wrote:I use linux and I compiled this on a windows laptop.
What? What is that supposed to be? A Windows laptop? I thought that you use Linux?
LPeter wrote:Does anyone have an idea what could be the problem?
Everybody on here who's decent at OSdeving will tell you that you didn't give enough information. What's your compiler? What parts of the headers are your exactly parsing, which information is used for what? Do you use a linker script? What are your compiler flags?

Lastly, I'm one of these guys who's too lazy to download a file and disassemble it. Providing the relevant parts as short snippets here would help me a lot, which, in turn, could have helped you a lot.

Please note: I'm just giving you some advice that will definitely help you. It's not meant to insult you in any way as a person or programmer.