Here is an algo to calculate the MS checksum value of a PE, it was presented by f0dder at Harold's forum:
MicrosoftCheckSum2 PROC C uses esi, buf:dword, len:dword
mov ecx, [len]
mov edx, [buf]
shr ecx, 1
xor eax, eax
clc
@@theLoop:
adc ax, [edx + (ecx * 2) - 2]
dec ecx
jnz @@theLoop
adc eax, [len]
ret
MicrosoftCheckSum2 ENDP
That code?
I originally wrote that on Hiro's original forum!
BTW the clc isn't needed, the XOR does it.
Mirno
Hi Mirno,
Yes, I checked it, you are right.
Kindly, please accept my apologies.