I have made (in assembler, without a linker) an EXE for x86-64 that runs perfectly well in Wine under Linux. It's a basic HelloWorld that calls MessageBoxA and ExitProcess.
Windows 10 won't recognize it, saying 'This program cannot be executed on your computer, talk to your vendor for a version that will suit your computer'.
I have used PE format readers (PE Tools and CFF Explorer) to analyze my PE EXE. All numbers in the PE Optional header are the same as in other working EXEs (like os versions, subsystem versions). Only the ones that are specific to my file and sections are different. And Windows won't recognize the file as executable on my computer.
Where do I even begin to look beyond the WIndows error message? Are there any tools that allow to check EXE validity with a more specific error messaging than 'Bad exe'? (this is what xdbg reports.
On Wine, I was able to do
WINEDEBUG=+all wine my.exe
and that gave me hints into what was wrong, and I was able to fix it and get it to work. Any such tools in Windows?
BITS 64
falign equ 1000h ; section file position modulo
imageBase equ 400000h
; MZ header
DOSHDR:
db 0x4D, 0x5A, 0x90, 0,
dd 3, 4, 0xFFFF, 0xB8, 0, 0x40, 0, 0, 0, 0, 0, 0, 0, 0
dd PEHDR
db 0x0E, 0x1F, 0xBA, 0x0E, 0x00, 0xB4, 0x09, 0xCD, 0x21, 0xB8, 0x01, 0x4C, 0xCD, 0x21, 0x54, 0x68, 0x69, 0x73, 0x20, 0x70, 0x72, 0x6F, 0x67, 0x72, 0x61, 0x6D, 0x20, 0x63, 0x61, 0x6E, 0x6E, 0x6F, 0x74, 0x20, 0x62, 0x65, 0x20, 0x72, 0x75, 0x6E, 0x20, 0x69, 0x6E, 0x20, 0x44, 0x4F, 0x53, 0x20, 0x6D, 0x6F, 0x64, 0x65, 0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
ALIGN falign, db 33h
doshdrSize equ $ - DOSHDR
MetaM: ; MetaBlk for module M
msg db "Hello, Ann!", 0
title db "Hello, Anna!", 0
titlew dw 42Fh, 44Ah, 0
msgw dw 416h, 42Bh, 0
title2w dw 44Ah, 42Fh, 0
ALIGN 8, db 0FEh
MessageBoxA dq 0
MessageBoxW dq 0
ExitProcess dq 0
MessageBoxW0 dq 0 ; a duplicate entry for User32.MessageBoxW
ALIGN falign, db 11h
metamSize equ $ - MetaM
CodeM:
BEGIN:
ENTRY:
sub rsp, 28h
mov rcx, 0 ; hWnd = HWND_DESKTOP
lea rdx, [imageBase + msg] ; LPCSTR lpText
lea r8, [imageBase + title] ; LPCSTR lpCaption
mov r9d, 0 ; uType = MB_OK
mov rax, [imageBase + MessageBoxA]
call rax
mov rcx, 0 ; hWnd = HWND_DESKTOP
lea rdx, [imageBase + msgw] ; LPCSTR lpText
lea r8, [imageBase + titlew] ; LPCSTR lpCaption
mov r9d, 0 ; uType = MB_OK
call [imageBase + MessageBoxW]
mov rcx, 0 ; hWnd = HWND_DESKTOP
lea rdx, [imageBase + msgw] ; LPCSTR lpText
lea r8, [imageBase + title2w] ; LPCSTR lpCaption
mov r9d, 0 ; uType = MB_OK
call [imageBase + MessageBoxW0]
mov ecx, eax
call [imageBase + ExitProcess]
END:
ALIGN falign, db 0AAh
codemSize equ $ - CodeM
IMPORTS:
; DLL names - iterate modules
user32dll db "USER32.DLL", 0
kernel32dll db "KERNEL32.DLL", 0
; Hint/Name entry - iterate externals
MessageBoxA_:
dq MessageBoxA__
dq 0
MessageBoxA__ db 0, 0, "MessageBoxA", 0,
ExitProcess_ dq ExitProcess__
dq 0
ExitProcess__ db 0, 0, "ExitProcess", 0, 1
MessageBoxW_:
dq MessageBoxW__
dq 0
MessageBoxW__ db 0, 0, "MessageBoxW", 0
ImportsDir:
; So this is the Directory, with one entry NOT for every imported DLL,
; but rather one entry for every use of an external name by a CP module
; that is, if a name is used in N modules, it will have N entries in the directory
dd MessageBoxA_, 0, 0, user32dll, MessageBoxA
dd ExitProcess_, 0, 0, kernel32dll, ExitProcess
dd MessageBoxW_, 0, 0, user32dll, MessageBoxW0
dd MessageBoxW_, 0, 0, user32dll, MessageBoxW
dd 0, 0, 0, 0, 0
directorySize equ $ - ImportsDir
importsSize equ $ - IMPORTS
PEHDR:
db "PE", 0, 0 ; signature
dw 8664h ; machine
dw 3 ; # of sections
dd 0 ; timedatestamp
dd 0 ; pointer to symtab - deprecated
dd 0 ; # symtab entries
dw opthdrSize ; size of optional header
dw 203h ; flags - characteristics
OPTHDR:
dw 20Bh ; magic
db 0 ; maj linker ver
db 1 ; minor linker ver
dd codemSize ; total code size
dd metamSize ; total init data size
dd 0 ; total uninit data size
dd ENTRY ; entrypoint RVA
dd ENTRY ; base of code
dq imageBase ; image base
dd 1000h ; section address alignment
dd falign ; section pos alignment
dw 5 ; major OS version
dw 2 ; minor OS version
dw 0 ; major image ver
dw 1 ; minor image ver
dw 5 ; major subsystem ver
dw 2 ; minor subsystem ver
dd 0 ; win32 version value = 0
dd fileSize ; size of image - that is, in memory!
dd ((doshdrSize + pehdrSize) + falign - 1) / falign * falign
; size of headers
dd 0 ; checksum
dw 2 ; subsystem: GUI = 2, CUI =3, NATIVE = 1
dw 0 ; dll characteristics
dq 1000000h ; max stack
dq 1000h ; min stack
dq 1000000h ; max heap
dq 1000h ; min heap
dd 0 ; loader flag = 0
; Directories
dd 2 ; number of directories
; export table hdr
dd 0, 0
; import table hdr
dd ImportsDir ; addr of import table
dd directorySize ; size of import table
;times 14 dq 0 ; end of directories
opthdrSize equ $ - OPTHDR
pehdrSize equ $ - PEHDR
Sections:
; MetaM
db "F", 0, 0, 0, 0 ; null name
dd metamSize ; size
dd MetaM ; addr RVA
dd metamSize ; length
dd MetaM ; pos
dd 0 ; no relocations
dd 0 ; no linenum
dw 0
dw 0
dd 0C0000040h ; flags: datasection writeable readable
; CodeM
db "W", 0 ; null name
dd codemSize ; size
dd CodeM ; addr RVA
dd codemSize ; length
dd CodeM ; pos
dd 0 ; no relocations
dd 0 ; no linenum
dw 0
dw 0
dd 0E0000020h ; flags: codesection writeable readable executable
; IMPORTS
db ".idata", 0, 0
dd importsSize ; size
dd IMPORTS ; addr RVA
dd importsSize ; length
dd IMPORTS ; pos
dd 0 ; no relocations
dd 0 ; no linenum
dw 0
dw 0
dd 0E0000020h ; flags: codesection writeable readable executable
fileSize equ $
;END:
