• Advertisement
Sign in to follow this  
  • entries
  • comments
  • views

Pure binary to C++ through PE

Sign in to follow this  


Hey everyone!

I am setting up the envirement that I will use for my Kernel, and I have decided to use MSVC++ 2005.

As you know, MSVC++ can only output COFF and PE object formats. Because of this, we have to parse (or strip) the header information to execute it from the Stage 2 bootloader.

I decided that stripping the header info was cheating, so decided to parse the image instead.

The Stage 2 bootloader loads the executable -- KRNL.DLL -- At 1 MB. So, to parse it, simply begin at offset 0x100000, and check certain bytes to get information while following the file format.

This is what I did:

; You are in pmode, and image is loaded at 1 MB...

mov ebx, [0x100000+60] ; e_lfanew is a 4 byte offset address of the PE header; it is 60th byte. Get it
add ebx, 0x100000 ; Add base address. EBX now points to file sig (PE00)

; jump over to optional header (Although it isnt optional o.0 )

add ebx, 24
mov ax, [ebx] ; _IMAGE_FILE_HEADER is 20 bytes + size of sig (4 bytes)
add ebx, 12

; ebx=address of entry point routine

jmp ebx ; Execute Kernel

Thats it!

The above 6 instructions only retrieves needed information to get the entry point routine within the EXE or DLL, and calls it.

As long as the file is a PE executable or DLL, Is loaded at base addess 0x100000, and CS=Code descriptor, the above will work for any program.

Because the entry point routine is called directly, this effectivly calls a C++ main entry routine from our pure binary Stage 2 bootloader. -Cool? [grin]

Of course--This assumes you already set up MSVC++ correctly to work in Kernel Land.
Sign in to follow this  


Recommended Comments

There are no comments to display.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Advertisement