https://en.wikipedia.org/wiki/The_Legend_of_Zelda_(video_gam...
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
INTERP 0x0000000000000088 0x0000000000010088 0x0000000000010088
0x000000000000001c 0x000000000000001c 0x0
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
DYNAMIC 0x00000000000000e0 0x00000000000100e0 0x6c2f343662696c2f <-- "/lib64/ld-linux-x86-64.so.2"
0x2d78756e696c2d64 0x732e34362d363878 0x322e6f
readelf: Error: the dynamic segment offset + size exceeds the size of the file
LOAD 0x0000000000000000 0x0000000000010000 0x0000000000000000
0x0000000000001dc0 0x0000000000005660 RWE 0x1000
Two questions:1. Was this done manually or is there a tool you're using which does this? I see other size-reduction tricks in here as well.
2. Does anybody know of a tool for examining executables which doesn't crap out on binaries like this?
- Browser: works after renaming to .html
- Linux: "./snake.com: line 20: lzma: command not found". Installing the xz package makes it work (already had XWayland enabled so X11 worked, but may be needed if you have a strict Wayland session).
- Windows: As either .com or renaming to .exe I get "The application was unable to start correctly (0xc0000005). Click OK to close the application." Not sure how to make this one work, it's definitely not AV related though (I have that stripped in this sandbox VM).
Edit: Got it working in all 3 now. On Windows I still had DEP enabled on all programs to test some apps earlier, turning that back off allowed it to launch.
https://web.archive.org/web/20100304155706/http://www.thepro...
The ability to load .html files over the file:// protocol is a powerful, often neglected feature. In practice, it means you can double-click an HTML file and it runs an app in your browser instantly.
With Haxe, you can write the application once, target both win32 and linux by compiling to C++ (which then you compile using the platform specific tooling for each paltform), and then target html by compiling to javascript. Then use the same concatenation mechanism and header abuse as described in the article to have all three targets merged into one file that can then be run on all platforms!
$ ./snake.com
./snake.com: line 20: /tmp/a: cannot execute binary fileLong live RCE. The thing looks interesting. Very close to a virus. Can it be used to make and spread a virus ?
Forma instance, a static compiled and linked "hello world" in C on Linux is around ~785KB
You could distribute it as `.html` only, and use JS to offer a local download link to itself in the correct extension. A polyglot installer, of sorts.
For example, this gist is an HTML that, when opened, offers a download zip of its DOM in whatever state it currently is:
https://gist.github.com/alganet/c904acb57282402fc0bd724f1eeb...
I think you can use something similar to get the entire page contents as a blob, but I never tested with binary data in actual browsers. Perhaps even patch it to avoid the initial windows error.
Content-Type: text/html