How does kernel get an executable binary file running under linux?

Best moments of the exec system call on Linux 4.0 The best way to find all of that out is to GDB step debug the kernel with QEMU: How to debug the Linux kernel with GDB and QEMU? fs/exec.c defines the system call at SYSCALL_DEFINE3(execve Simply forwards to do_execve. do_execve Forwards to do_execveat_common. do_execveat_common To … Read more

What is the smallest possible Windows (PE) executable?

As quoted from source (Creating the smallest possible PE executable): 1 Smallest possible PE file: 97 bytes Smallest possible PE file on Windows 2000: 133 bytes Smallest PE file that downloads a file over WebDAV and executes it: 133 bytes The files above are the smallest possible PE files due to requirements of the PE … Read more

Why does the PLT exist in addition to the GOT, instead of just using the GOT?

The problem is that replacing call printf@PLT with call [printf@GOTPLT] requires that the compiler knows that the function printf exists in a shared library and not a static library (or even in just a plain object file). The linker can change call printf into call printf@PLT, jmp printf into jmp printf@PLT or even mov eax, … Read more

Antivirus False positive in my executable

It is surprisingly common that Delphi applications are reported as (potentially) harmful by AV applications. It happened to me a while ago, using Delphi 2009, see http://en.wikipedia.org/wiki/Wikipedia:Reference_desk/Archives/Computing/2010_March_20#Delphi.2FAVG_Issue. At SO, we also have Virus in Delphi 7 Accidentally created a virus? and many more. It might be the actual Induc Virus. But most likely, it is … Read more

what’s in a .exe file?

MSDN has an article “An In-Depth Look into the Win32 Portable Executable File Format” that describes the structure of an executable file. Basically, a .exe contains several blobs of data and instructions on how they should be loaded into memory. Some of these sections happen to contain machine code that can be executed (other sections … Read more

How to check if a program is using .NET?

There’s a trick I once learned from Scott Hanselman’s list of interview questions. You can easily list all programs running .NET in command prompt by using: tasklist /m “mscor*” It will list all processes that have mscor* amongst their loaded modules. We can apply the same method in code: public static bool IsDotNetProcess(this Process process) … Read more