waliedassar Posted September 28, 2012 Share Posted September 28, 2012 Here you can find ithttp://waleedassar.blogspot.com/2012/09/pageexecutewritecopy-as-anti-debug-trick.htmlAny ideas or comments are more than welcome. 1 Link to comment Share on other sites More sharing options...
kakamail Posted September 28, 2012 Share Posted September 28, 2012 Your file does not run on my SP2. Sorry i don't have c compiler on my pc. Link to comment Share on other sites More sharing options...
waliedassar Posted September 28, 2012 Author Share Posted September 28, 2012 (edited) This is due to Microsoft Visual Studio embedding an RT_MANIFEST (24, 0x18) resource in the final executable. This manifest requests a specific version of msvcrt.dll from your winsxs which is apparently not installed on your system.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.6195" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity> </dependentAssembly> </dependency></assembly>Install Microsoft Visual C++ redistributable 2005 or just set the RVA and Size of resource table in the PE to zero.Or take this resource-less version of the demo.http://code.google.c...Copy_Trick_.exe Edited September 28, 2012 by waliedassar 1 Link to comment Share on other sites More sharing options...
Shub-Nigurrath Posted October 8, 2012 Share Posted October 8, 2012 you could compile it as an xADT plugin? Just for fun. 1 Link to comment Share on other sites More sharing options...
ghandi Posted October 13, 2012 Share Posted October 13, 2012 Minus the SxS attribute, easily changed in the project settings plus using static runtime so that although the resulting binary may be larger it will run on machines regardless of runtime installed.HR,Ghandi 1 Link to comment Share on other sites More sharing options...
mudlord Posted October 13, 2012 Share Posted October 13, 2012 Or you could link against MSVC6 runtimes to remove said dependancy.Yes, I done it before for my demoscene prods. 1 Link to comment Share on other sites More sharing options...
ghandi Posted October 14, 2012 Share Posted October 14, 2012 A good point also, possibly even the better approach as it keeps the binary size down as well as linking against runtime that should exist on any XP+ machine.HR,Ghandi Link to comment Share on other sites More sharing options...
mudlord Posted October 14, 2012 Share Posted October 14, 2012 Indeed, MSVCRT.DLL existed during the Win98 days even..o_o Link to comment Share on other sites More sharing options...
ghandi Posted October 16, 2012 Share Posted October 16, 2012 (edited) Sorry for the delayed reply, I said that because XP was the first OS which shipped with it factory, wasn't it? Correct me if i'm wrong but pre-XP the runtime had to be installed to be present, or so i thought, :/HR,Ghandi Edited October 16, 2012 by ghandi Link to comment Share on other sites More sharing options...
mudlord Posted October 17, 2012 Share Posted October 17, 2012 hmmm, I think it came with 98SE too..., around the same time VC6 was released. Link to comment Share on other sites More sharing options...
ghandi Posted October 18, 2012 Share Posted October 18, 2012 Nice, thanks for that. HR, Ghandi Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now