PE version patcher

[jj2007]

Holly Sh.*?! I was just kidding.  :clap:

I wonder this really works in every case ?! ::)

You can patch a file with a known offset with this four-liner. But as shown later, the offset is not fixed...

[Ghandi]

Is the subsystem version of any importance with this 'problem' of running newer linked executables on Win2000?

The code isn't pretty, but it uses memory mapped files to edit the MajorOperatingSystemVersion and MinorOperatingSystemVersion members of the PE header. I haven't commented the code but it should be pretty plain what it does. Don't pay attention to my poor coding, just take the concept out of there and make what you want with it if you so desire. :D Any questions, feel free to ask, if i'll answer them the best i can.

Btw, i know there is a typo in at least one of the messagebox texts, it should read "must" not "muse", a distance of two keys. Which if you look at it from a different perspective, isn't too bad an effort, because i totally missed 'r' when doing that particular typo and i didn't even notice it until i'd uploaded the zip file to the forum, o0.

HR,
Ghandi

[gwapo]

Perhaps you want

Code Select Expand

/SUBSYSTEM:WINDOWS,4.00 or

Code Select Expand

/SUBSYSTEM:CONSOLE,4.00

LINK : warning LNK4010: invalid subsystem version number 4.00; default subsystem version assumed

That what I was talking about above MS "intentionally" crippled the linker. ::)
Prehabs they want to prevent something else like not to try run .NET 3.0 on Windows 2000 or god knows.

Windows OS version 4.0 is Windows 95. If you want your program to run on Windows 2000 and above, the default version 5.0 should work. Windows 2000 = 5.0

[jj2007]

For testing...

Code Select Expand

include \masm32\MasmBasic\MasmBasic.inc
memwrd MACRO memptr
  movzx eax, word ptr memptr
  EXITM <eax>
ENDM
Init
Let esi=FileRead$(CL$())  ; utterly inefficient to read in the whole file ;-)
mov ebx, [esi+3Ch]
Print Str$("MajorOS    \t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MajorOperatingSystemVersion[esi+ebx]))
Print Str$("MinorOS    \t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MinorOperatingSystemVersion[esi+ebx]))
Print Str$("MajorImage\t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MajorImageVersion[esi+ebx]))
Print Str$("MinorImage\t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MinorImageVersion[esi+ebx]))
Print Str$("MajorSubSys\t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MajorSubsystemVersion[esi+ebx]))
Print Str$("MinorSubSys\t%i\n", memwrd(IMAGE_NT_HEADERS.OptionalHeader.MinorSubsystemVersion[esi+ebx]))
Inkey "-- info refers to ", CL$(), " --"
Exit
end start


Output:

Code Select Expand

MajorOS         4
MinorOS         0
MajorImage      10
MinorImage      0
MajorSubSys     4
MinorSubSys     0
-- info refers to C:\Program Files\Microsoft Office\Office12\WINWORD.EXE --

The executable is attached.

[Ghandi]

If you are worried about file size, you can read in 40h bytes from the file and check the DOS signature, then use the e_lfanew member to set the file pointer again so its pointing at the actual PE header signature. From there you can access any part of the PE header and this approach is used a fair bit in applications i've seen which handle larger PE file access without loading it fully to memory.

A question regarding memory mapped files, if you have mapped a large file but not accessed the memory, is it paged in from the word go or does that happen automagically? I was under the impression that it would be paged in as the access demanded it, otherwise it would suck all of the memory from the OS.

HR,
Ghandi

[jj2007]

If you are worried about file size,

No, I am not worried. Just lazy.

Code Select Expand

; Let esi=FileRead$(CL$())  ; utterly inefficient to read in the whole file ;-)
Let esi=New$(4096)
Open "I", #1, CL$()
Input #1, esi, Lof(#1)
Close


[Ficko]

I made some tests with the CFF Explorer and just wanna make some clarification.

Looks like the "MinorSubsystemVersion" + has to be (0) to run under W2.
So 5.0 is ok.

The problem is SOLVED. :toothy

Since

/SUBSYSTEM:CONSOLE,5.00

is OK.

No more patching. :U

[Ghandi]

I wasn't referring to your code jj, i meant my code, i mapped the whole file with MapViewOfFile.

HR,
Ghandi

[Queue]

I made some tests with the CFF Explorer and just wanna make some clarification.

Looks like the "MinorSubsystemVersion" + has to be (0) to run under W2.
So 5.0 is ok.

The problem is SOLVED. :toothy

Since

/SUBSYSTEM:CONSOLE,5.00

is OK.

No more patching. :U

Unless you want it to run on all 32-bit versions of Windows, in which case 5.0 is inadequate.

http://www.steelbytes.com/?mid=47

That's the best utility I've seen for achieving this, and does more than simply changing the subsystem version.

Queue

[jj2007]

I wasn't referring to your code jj, i meant my code, i mapped the whole file with MapViewOfFile.

So we have the same bad habits :wink

[Ficko]

Code Select Expand


Unless you want it to run on all 32-bit versions of Windows, in which case 5.0 is inadequate.


You right and still need a patcher for prgs you don't have the source. :wink

[GregL]

I did a little research of what the default version is when the version is not specified in /SUBSYSTEM.

VS 6.0               4.00
VS 2003 (7.0)        4.00
VS 2005 (8.0)        4.00
VS 2008 (9.0)        5.00
VS 2010 (10.0)       5.00

See /SUBSYSTEM

[clive]

You right and still need a patcher for prgs you don't have the source. :wink

Code Select Expand

Microsoft (R) COFF Binary File Editor Version 6.00.8168
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.

usage: EDITBIN [options] [files]

   options:

      /BIND[:PATH=path]
      /HEAP:reserve[,commit]
      /LARGEADDRESSAWARE[:NO]
      /NOLOGO
      /REBASE[:[BASE=address][,BASEFILE][,DOWN]]
      /RELEASE
      /SECTION:name[=newname][,[[!]{cdeikomprsuw}][a{1248ptsx}]]
      /STACK:reserve[,commit]
      /SUBSYSTEM:{NATIVE|WINDOWS|CONSOLE|WINDOWSCE|POSIX}[,#[.##]]
      /SWAPRUN:{[!]CD|[!]NET}
      /VERSION:#[.#]
      /WS:[!]AGGRESSIVE

The other Microsoft tool that comes to mind is REBASE.EXE, but it doesn't have options to change the SUBSYSTEM stuff.

[Queue]

Like DUMPBIN and LIB, EDITBIN is simply a forwarder to LINK.EXE.

DUMPBIN = LINK.EXE -dump
EDITBIN = LINK.EXE -edit
LIB = LINK.EXE -lib

Queue