On 22.07.2013 09:59, Tom Del Rosso wrote:> Herbert Kleebauer wrote:
>>>> winpos.exe: specify the position for the Command Window
>
> Avast says it has win32-evo-gen, not that I believe it.
A 1024 byte Windows exe with a virus? Would like to see
such a thing.
http://virusscan.jotti.org
uses 22 Scanner (including Avast) and non reports a virus.
But that's the advantage of assembly programming: you know
the purpose of any of the 1024 bytes in the exe:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; winpos.mac: Positioniert das Command Window an der angegebenen;;
;; Stelle ;;
;; usage: winpos [T] xpos ypos ;;
;; falls T angegeben wird das Window TOPMOST ;;
;; example: winpos -> neue Posuition 0,0 ;;
;; winpos 100 200 -> neue Position 100,200 ;;
;; winpos T 200 -> neue Position 200,0 TOPMOST ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
UseIdatSection=0 ; 0 if no idat section is used
UseUdatSection=0 ; 0 if no udat section is used
;#==================================================================#
;# Start of Headers #
;#==================================================================#
; +--------------------------------------------+
; | Start of DOS Header |
; +--------------------------------------------+
; DOS .EXE header
00000000: 00000000: 4d 5a dc.b 'MZ' ; Magic number
00000002: 00000002: 0160 dc.w dosfilesize\512 ; Bytes on last page of file (0->512)
00000004: 00000004: 0001 dc.w (dosfilesize-1)/512+1
; Pages in file (Page=512 byte)
00000006: 00000006: 0000 dc.w 0 ; Relocations (nr of entries)
00000008: 00000008: 0004 dc.w doshead_end/16 ; Size of header size in paragraphs (16 byte)
0000000a: 0000000a: 0000 dc.w 0 ; Minimum extra paragraphs needed
0000000c: 0000000c: ffff dc.w $ffff ; Maximum extra paragraphs needed
0000000e: 0000000e: 0000 dc.w 0 ; Initial (relative) SS value (ss=load_adr+nr)
00000010: 00000010: 0160 dc.w dosstack ; Initial SP value
00000012: 00000012: 0000 dc.w 0 ; Checksum
00000014: 00000014: 0000 dc.w dosmain ; Initial IP value
00000016: 00000016: 0000 dc.w 0 ; Initial (relative) CS value (cs=load_adr+nr)
00000018: 00000018: 0040 dc.w reloc ; File address of relocation table
0000001a: 0000001a: 0000 dc.w 0 ; Overlay number
0000001c: 0000001c: 0000 0000 0000
00000022: 00000022: 0000 dc.w 0,0,0,0 ; Reserved words
00000024: 00000024: 0000 dc.w 0 ; OEM identifier (for e_oeminfo)
00000026: 00000026: 0000 dc.w 0 ; OEM information; e_oemid specific
00000028: 00000028: 00000000 00000000
00000030: 00000030: 00000000 00000000
00000038: 00000038: 00000000 dc.l 0,0,0,0,0 ; Reserved words
0000003c: 0000003c: 000000a0 dc.l WinHeader ; File address of new exe header
reloc:
doshead_end:
@=$0
00000040: 00000000: 0e dosmain:move.w s6,-(sp)
00000041: 00000001: 1f move.w (sp)+,s0
00000042: 00000002: ba 000e move.w #_text,r1
00000045: 00000005: b4 09 move.b #$09,m0
00000047: 00000007: cd 21 trap #$21
00000049: 00000009: b8 4c01 move.w #$4c01,r0
0000004c: 0000000c: cd 21 trap #$21
0000004e: 0000000e: 4e 69 63 65 20 74
00000054: 00000014: 6f 20 6d 65 65 74
0000005a: 0000001a: 20 73 6f 6d 65 62
00000060: 00000020: 6f 64 79 20 77 68
00000066: 00000026: 6f 20 69 73 20 73
0000006c: 0000002c: 74 69 6c 6c 20 75
00000072: 00000032: 73 69 6e 67 20 44
00000078: 00000038: 4f 53 2c 0d 0a _text: dc.b 'Nice to meet somebody who is still using DOS,',13,10
0000007d: 0000003d: 62 75 74 20 74 68
00000083: 00000043: 69 73 20 70 72 6f
00000089: 00000049: 67 72 61 6d 20 72
0000008f: 0000004f: 65 71 75 69 72 65
00000095: 00000055: 73 20 57 69 6e 33
0000009b: 0000005b: 32 2e 0d 0a 24 dc.b 'but this program requires Win32.',13,10,'$'
even 16
dosstack=@+256 ; 256 Byte stack
dosfilesize=@+256
; +--------------------------------------------+
; | End of DOS Header |
; +--------------------------------------------+
; +--------------------------------------------+
; | Start of Windows Header |
; +--------------------------------------------+
ImageBase== $00400000
SectionAlignment== 4096
FileAlignment== 512
WinHeader=@@
@=ImageBase
; see WINNT.H for information
000000a0: 00400000: 50 45 00 00 dc.b 'PE',0,0 ; magic word
; _IMAGE_FILE_HEADER:
000000a4: 00400004: 014c dc.w $014c ; Machine ($014c=Intel x86 processor)
000000a6: 00400006: 0001 dc.w NumberOfSections ; NumberOfSections
000000a8: 00400008: 36a57950 dc.l $36a57950 ; TimeDateStamp (seconds since 31.12.69 16:00)
000000ac: 0040000c: 00000000 dc.l 0 ; PointerToSymbolTable
000000b0: 00400010: 00000000 dc.l 0 ; NumberOfSymbols
000000b4: 00400014: 00e0 dc.w SizeOfOptionalHeader ; SizeOfOptionalHeader
000000b6: 00400016: 010f dc.w $010f ; Charcteristics
; 0x0001 Relocation info stripped from file.
; 0x0002 File is executable (i.e. no unresolved externel references).
; 0x0004 Line nunbers stripped from file.
; 0x0008 Local symbols stripped from file.
; 0x0010 Agressively trim working set
; 0x0080 Bytes of machine word are reversed.
; 0x0100 32 bit word machine.
; 0x0200 Debugging info stripped from file in .DBG file
; 0x0400 If Image is on removable media, copy and run from the swap file.
; 0x0800 If Image is on Net, copy and run from the swap file.
; 0x1000 System File.
; 0x2000 File is a DLL.
; 0x4000 File should only be run on a UP machine
; 0x8000 Bytes of machine word are reversed.
@a=@ ; _IMAGE_OPTIONAL_HEADER
000000b8: 00400018: 010b dc.w $010b ; Magic
000000ba: 0040001a: 05 dc.b 5 ; MajorLinkerVersion
000000bb: 0040001b: 0c dc.b 12 ; MinorLinkerVersion
000000bc: 0040001c: 00000200 dc.l SizeOfCode ; SizeOfCode
000000c0: 00400020: 00000000 dc.l SizeOfInitializedData ; SizeOfInitializedData
000000c4: 00400024: 00000000 dc.l SizeOfUninitializedData ; SizeOfUninitializedData
000000c8: 00400028: 000010ca dc.l winmain-ImageBase ; AddressOfEntryPoint
000000cc: 0040002c: 00001000 dc.l BaseOfCode ; BaseOfCode
000000d0: 00400030: 00002000 dc.l BaseOfData ; BaseOfData
000000d4: 00400034: 00400000 dc.l ImageBase ; ImageBase
000000d8: 00400038: 00001000 dc.l SectionAlignment ; SectionAlignment
000000dc: 0040003c: 00000200 dc.l FileAlignment ; FileAlignment
000000e0: 00400040: 0005 dc.w 5 ; MajorOperatingSystemVersion
000000e2: 00400042: 0000 dc.w 0 ; MinorOperatingSystemVersion
000000e4: 00400044: 0000 dc.w 0 ; MajorImageVersion
000000e6: 00400046: 0000 dc.w 0 ; MinorImageVersion
000000e8: 00400048: 0005 dc.w 5 ; MajorSubsystemVersion
000000ea: 0040004a: 0000 dc.w 0 ; MinorSubsystemVersion
000000ec: 0040004c: 00000000 dc.l 0 ; Win32VersionValue
000000f0: 00400050: 00002000 dc.l SizeOfImage ; SizeOfImage
000000f4: 00400054: 00000200 dc.l SizeOfHeaders ; SizeOfHeaders
000000f8: 00400058: 00000000 dc.l 0 ; CheckSum
000000fc: 0040005c: 0003 dc.w 3 ; Subsystem
; 0: Unknown subsystem.
; 1: Image doesn't require a subsystem.
; 2: Image runs in the Windows GUI subsystem.
; 3: Image runs in the Windows character subsystem.
; 5: image runs in the OS/2 character subsystem.
; 7: image run in the Posix character subsystem.
; 8: image run in the 8 subsystem.
000000fe: 0040005e: 0000 dc.w $0000 ; DllCharacteristics
00000100: 00400060: 00100000 dc.l $00100000 ; SizeOfStackReserve
00000104: 00400064: 00001000 dc.l $00001000 ; SizeOfStackCommit
00000108: 00400068: 00100000 dc.l $00100000 ; SizeOfHeapReserve
0000010c: 0040006c: 00001000 dc.l $00001000 ; SizeOfHeapCommit
00000110: 00400070: 00000000 dc.l $00000000 ; LoaderFlags
00000114: 00400074: 00000010 dc.l NumberOfRvaAndSize ; NumberOfRvaAndSize (entries
; in the data dir)
; ..............................................
; : Start of Image Data Directory :
; ..............................................
; virtual address, size
@b=@
00000118: 00400078: 00000000 00000000 dc.l 0,0 ; Export Directory
00000120: 00400080: 00001018 0000003c dc.l imp_start,imp_size ; Import Directory
00000128: 00400088: 00000000 00000000 dc.l 0,0 ; Resource Directory
00000130: 00400090: 00000000 00000000 dc.l 0,0 ; Exception Directory
00000138: 00400098: 00000000 00000000 dc.l 0,0 ; Security Directory
00000140: 004000a0: 00000000 00000000 dc.l 0,0 ; Base Relocation Table
00000148: 004000a8: 00000000 00000000 dc.l 0,0 ; Debug Directory
00000150: 004000b0: 00000000 00000000 dc.l 0,0 ; Description String
00000158: 004000b8: 00000000 00000000 dc.l 0,0 ; Machine Value (MIPS GP)
00000160: 004000c0: 00000000 00000000 dc.l 0,0 ; TLS Directory
00000168: 004000c8: 00000000 00000000 dc.l 0,0 ; Load Configuration Directory
00000170: 004000d0: 00000000 00000000 dc.l 0,0 ; Bound Import Directory in headers
00000178: 004000d8: 00001000 00000018 dc.l iat_start,iat_size ; Import Address Table
00000180: 004000e0: 00000000 00000000 dc.l 0,0 ; 14
00000188: 004000e8: 00000000 00000000 dc.l 0,0 ; 15
00000190: 004000f0: 00000000 00000000 dc.l 0,0 ; 16
NumberOfRvaAndSize = (@-@b)/8
SizeOfOptionalHeader = @-@a
; ..............................................
; : End of Image Data Directory :
; ..............................................
; ..............................................
; : Start of Image Sections Header :
; ..............................................
@a=@
00000198: 004000f8: 2e 74 65 78 74 00
0000019e: 004000fe: 00 00 dc.b '.text',0,0,0 ; name
000001a0: 00400100: 00000164 dc.l VSizeOf_text ; virtual size
000001a4: 00400104: 00001000 dc.l VBaseOf_text ; virtual address
000001a8: 00400108: 00000200 dc.l FSizeOf_text ; size of raw data
000001ac: 0040010c: 00000200 dc.l FBaseOf_text ; pointer to raw data
000001b0: 00400110: 00000000 dc.l 0 ; pointer to relocatins
000001b4: 00400114: 00000000 dc.l 0 ; pointer to line numbers
000001b8: 00400118: 0000 dc.w 0 ; number of relocations
000001ba: 0040011a: 0000 dc.w 0 ; number of line numbers
000001bc: 0040011c: e0000020 dc.l $e0000020 ; characteristics
IF UseIdatSection
dc.b '.idat',0,0,0 ; name
dc.l VSizeOf_idat ; virtual size
dc.l VBaseOf_idat ; virtual address
dc.l FSizeOf_idat ; size of raw data
dc.l FBaseOf_idat ; pointer to raw data
dc.l 0 ; pointer to relocatins
dc.l 0 ; pointer to line numbers
dc.w 0 ; number of relocations
dc.w 0 ; number of line numbers
dc.l $e0000040 ; characteristics
ENDIF
IF UseUdatSection
dc.b '.udat',0,0,0 ; name
dc.l VSizeOf_udat ; virtual size
dc.l VBaseOf_udat ; virtual address
dc.l FSizeOf_udat ; size of raw data
dc.l FBaseOf_udat ; pointer to raw data
dc.l 0 ; pointer to relocatins
dc.l 0 ; pointer to line numbers
dc.w 0 ; number of relocations
dc.w 0 ; number of line numbers
dc.l $e0000080 ; characteristics
ENDIF
NumberOfSections=(@-@a)/40
; ..............................................
; : End of Image Sections Header :
; ..............................................
; characteristics
; 0x00000020 // Section contains code.
; 0x00000040 // Section contains initialized data.
; 0x00000080 // Section contains uninitialized data.
; 0x00000200 // Section contains comments or some other type of information.
; 0x00000800 // Section contents will not become part of image.
; 0x00001000 // Section contents comdat.
; 0x01000000 // Section contains extended relocations.
; 0x02000000 // Section can be discarded.
; 0x04000000 // Section is not cachable.
; 0x08000000 // Section is not pageable.
; 0x10000000 // Section is shareable.
; 0x20000000 // Section is executable.
; 0x40000000 // Section is readable.
; 0x80000000 // Section is writeable.
; +--------------------------------------------+
; | End of Windows Header |
; +--------------------------------------------+
000001c0: 00400120: 00 00 00 00 00 00
000001c6: 00400126: 00 00 00 00 00 00
000001cc: 0040012c: 00 00 00 00 00 00
000001d2: 00400132: 00 00 00 00 00 00
000001d8: 00400138: 00 00 00 00 00 00
000001de: 0040013e: 00 00 00 00 00 00
000001e4: 00400144: 00 00 00 00 00 00
000001ea: 0040014a: 00 00 00 00 00 00
000001f0: 00400150: 00 00 00 00 00 00
000001f6: 00400156: 00 00 00 00 00 00
000001fc: 0040015c: 00 00 00 00 evencom FileAlignment
SizeOfHeaders==@@
;#==================================================================#
;# End of Headers #
;#==================================================================#
;#==================================================================#
;# Start of Sections #
;#==================================================================#
; +--------------------------------------------+
; | Start of .text Section |
; +--------------------------------------------+
FBaseOf_text==@@
VBaseOf_text==(@-ImageBase+SectionAlignment-1)/SectionAlignment*SectionAlignment
BaseOfCode==VBaseOf_text
@=ImageBase+VBaseOf_text
; ..............................................
; : Start of Thunk Table :
; ..............................................
iat_start=@-ImageBase
USER32_thunk:
00000200: 00401000: 00001068 SetWindowPos:: dc.l USER32_SetWindowPos -ImageBase
00000204: 00401004: 00000000 dc.l 0
KERNEL32_thunk:
00000208: 00401008: 00001096 GetCommandLine:: dc.l KERNEL32_GetCommandLine -Imagebase
0000020c: 0040100c: 000010a8 GetConsoleWindow:: dc.l KERNEL32_GetConsoleWindow -Imagebase
00000210: 00401010: 000010bc ExitProcess:: dc.l KERNEL32_ExitProcess -ImageBase
00000214: 00401014: 00000000 dc.l 0
iat_size=@-ImageBase-iat_start
; ..............................................
; : End of Thunk Table :
; ..............................................
; ..............................................
; : Start of Import Directory :
; ..............................................
imp_start==@-ImageBase
imp:
00000218: 00401018: 00001060 dc.l USER32_import -ImageBase
0000021c: 0040101c: 00000000 dc.l 0
00000220: 00401020: 00000000 dc.l 0
00000224: 00401024: 00001054 dc.l USER32_name -ImageBase
00000228: 00401028: 00001000 dc.l USER32_thunk -ImageBase
0000022c: 0040102c: 00001086 dc.l KERNEL32_import -ImageBase
00000230: 00401030: 00000000 dc.l 0
00000234: 00401034: 00000000 dc.l 0
00000238: 00401038: 00001078 dc.l KERNEL32_name -ImageBase
0000023c: 0040103c: 00001008 dc.l KERNEL32_thunk -ImageBase
00000240: 00401040: 00000000 dc.l 0
00000244: 00401044: 00000000 dc.l 0
00000248: 00401048: 00000000 dc.l 0
0000024c: 0040104c: 00000000 dc.l 0
00000250: 00401050: 00000000 dc.l 0
imp_size==@-imp
; ..............................................
; : End of Import Directory :
; ..............................................
USER32_name:
00000254: 00401054: 55 53 45 52 33 32
0000025a: 0040105a: 2e 64 6c 6c 00 dc.b 'USER32.dll',0
0000025f: 0040105f: 00 even
USER32_import:
00000260: 00401060: 00001068 dc.l USER32_SetWindowPos -ImageBase
00000264: 00401064: 00000000 dc.l 0
even
USER32_SetWindowPos:
00000268: 00401068: 0000 dc.w 0
0000026a: 0040106a: 53 65 74 57 69 6e
00000270: 00401070: 64 6f 77 50 6f 73
00000276: 00401076: 00 dc.b 'SetWindowPos',0
00000277: 00401077: 00 even
KERNEL32_name:
00000278: 00401078: 4b 45 52 4e 45 4c
0000027e: 0040107e: 33 32 2e 64 6c 6c
00000284: 00401084: 00 dc.b 'KERNEL32.dll',0
00000285: 00401085: 00 even
KERNEL32_import:
00000286: 00401086: 00001096 dc.l KERNEL32_GetCommandLine -ImageBase
0000028a: 0040108a: 000010a8 dc.l KERNEL32_GetConsoleWindow -ImageBase
0000028e: 0040108e: 000010bc dc.l KERNEL32_ExitProcess -ImageBase
00000292: 00401092: 00000000 dc.l 0
even
KERNEL32_GetCommandLine:
00000296: 00401096: 0000 dc.w 0
00000298: 00401098: 47 65 74 43 6f 6d
0000029e: 0040109e: 6d 61 6e 64 4c 69
000002a4: 004010a4: 6e 65 41 00 dc.b 'GetCommandLineA',0
even
KERNEL32_GetConsoleWindow:
000002a8: 004010a8: 0000 dc.w 0
000002aa: 004010aa: 47 65 74 43 6f 6e
000002b0: 004010b0: 73 6f 6c 65 57 69
000002b6: 004010b6: 6e 64 6f 77 00 dc.b 'GetConsoleWindow',0
000002bb: 004010bb: 00 even
KERNEL32_ExitProcess:
000002bc: 004010bc: 0000 dc.w 0
000002be: 004010be: 45 78 69 74 50 72
000002c4: 004010c4: 6f 63 65 73 73 00 dc.b 'ExitProcess',0
even
; ..............................................
; : Start of Code :
; ..............................................
label_block
seg32
winmain::
000002ca: 004010ca: ff 15 00401008 jsr.l (GetCommandLine)
; skip program name
000002d0: 004010d0: 31 d2 eor.l r1,r1 ; not within "" flag
000002d2: 004010d2: 48 dec.l r0
000002d3: 004010d3: 40 _20: inc.l r0
000002d4: 004010d4: 80 38 00 cmp.b #0,(r0)
000002d7: 004010d7: 74 11 beq.b _10
000002d9: 004010d9: 80 38 22 cmp.b #'"',(r0)
000002dc: 004010dc: 75 02 bne.b _30
000002de: 004010de: f7 d2 not.l r1
000002e0: 004010e0: 09 d2 _30: or.l r1,r1
000002e2: 004010e2: 75 ef bne.b _20
000002e4: 004010e4: 80 38 20 cmp.b #' ',(r0)
000002e7: 004010e7: 75 ea bne.b _20
000002e9: 004010e9: 40 inc.l r0
000002ea: 004010ea: 31 ed _10: eor.l r4,r4
000002ec: 004010ec: e8 0000002b bsr.l get_dec_r6
000002f1: 004010f1: 89 fe move.l r6,r5
000002f3: 004010f3: e8 00000024 bsr.l get_dec_r6
000002f8: 004010f8: 83 ed 02 subq.l #2,r4
000002fb: 004010fb: ff 15 0040100c jsr.l (GetConsoleWindow)
00000301: 00401101: 68 00000001 move.l #$0001,-(sp) ; SWP_NOSIZE
00000306: 00401106: 6a 00 moveq.l #0,-(sp) ; cy (ignored)
00000308: 00401108: 6a 00 moveq.l #0,-(sp) ; cx (ignored)
0000030a: 0040110a: 57 move.l r6,-(sp) ; y
0000030b: 0040110b: 56 move.l r5,-(sp) ; x
0000030c: 0040110c: 55 move.l r4,-(sp) ;-1: HWND_TOPMOST -1: HWND_NOTOPMOST
0000030d: 0040110d: 50 move.l r0,-(sp)
0000030e: 0040110e: ff 15 00401000 jsr.l (SetWindowPos)
00000314: 00401114: 6a 00 moveq.l #0,-(sp)
00000316: 00401116: ff 15 00401010 jsr.l (ExitProcess) ; exit program
get_dec_r6:
0000031c: 0040111c: 31 ff eor.l r6,r6
0000031e: 0040111e: 31 c9 eor.l r2,r2
00000320: 00401120: 0f b6 10 _20: movu.bl (r0),r1
00000323: 00401123: 08 d2 or.b r1,r1
00000325: 00401125: 74 36 beq.b _10
00000327: 00401127: 40 inc.l r0
00000328: 00401128: 80 fa 2d cmp.b #'-',r1
0000032b: 0040112b: 74 16 beq.b _40
0000032d: 0040112d: 80 fa 54 cmp.b #'T',r1
00000330: 00401130: 75 05 bne.b _21
00000332: 00401132: bd 00000001 move.l #1,r4
00000337: 00401137: 80 ea 30 _21: sub.b #'0',r1
0000033a: 0040113a: 72 e4 bcs.b _20
0000033c: 0040113c: 80 fa 09 cmp.b #9,r1
0000033f: 0040113f: 77 df bhi.b _20
00000341: 00401141: eb 13 br.b _31
00000343: 00401143: 49 _40: dec.l r2
00000344: 00401144: 0f b6 10 _30: movu.bl (r0),r1
00000347: 00401147: 08 d2 or.b r1,r1
00000349: 00401149: 74 12 beq.b _10
0000034b: 0040114b: 40 inc.l r0
0000034c: 0040114c: 80 ea 30 sub.b #'0',r1
0000034f: 0040114f: 72 0c bcs.b _10
00000351: 00401151: 80 fa 09 cmp.b #9,r1
00000354: 00401154: 77 07 bhi.b _10
00000356: 00401156: 6b ff 0a _31: mulsq.l #10,r6,r6
00000359: 00401159: 01 d7 add.l r1,r6
0000035b: 0040115b: eb e7 br.b _30
0000035d: 0040115d: 09 c9 _10: or.l r2,r2
0000035f: 0040115f: 74 02 beq.b _11
00000361: 00401161: f7 df neg.l r6
00000363: 00401163: c3 _11: rts.l
; ..............................................
; : End of Code :
; ..............................................
VSizeOf_text==@-Imagebase-VBaseOf_text
@a=@
00000364: 00401164: 00 00 00 00 00 00
0000036a: 0040116a: 00 00 00 00 00 00
00000370: 00401170: 00 00 00 00 00 00
00000376: 00401176: 00 00 00 00 00 00
0000037c: 0040117c: 00 00 00 00 00 00
00000382: 00401182: 00 00 00 00 00 00
00000388: 00401188: 00 00 00 00 00 00
0000038e: 0040118e: 00 00 00 00 00 00
00000394: 00401194: 00 00 00 00 00 00
0000039a: 0040119a: 00 00 00 00 00 00
000003a0: 004011a0: 00 00 00 00 00 00
000003a6: 004011a6: 00 00 00 00 00 00
000003ac: 004011ac: 00 00 00 00 00 00
000003b2: 004011b2: 00 00 00 00 00 00
000003b8: 004011b8: 00 00 00 00 00 00
000003be: 004011be: 00 00 00 00 00 00
000003c4: 004011c4: 00 00 00 00 00 00
000003ca: 004011ca: 00 00 00 00 00 00
000003d0: 004011d0: 00 00 00 00 00 00
000003d6: 004011d6: 00 00 00 00 00 00
000003dc: 004011dc: 00 00 00 00 00 00
000003e2: 004011e2: 00 00 00 00 00 00
000003e8: 004011e8: 00 00 00 00 00 00
000003ee: 004011ee: 00 00 00 00 00 00
000003f4: 004011f4: 00 00 00 00 00 00
000003fa: 004011fa: 00 00 00 00 00 00 evencom FileAlignment
@=@a
FSizeOf_text==@@-FBaseOf_text
SizeOfCode==FSizeOf_text
; +--------------------------------------------+
; | End of .text Section |
; +--------------------------------------------+
; +--------------------------------------------+
; | Start of .idat Section |
; +--------------------------------------------+
FBaseOf_idat==@@
VBaseOf_idat==(@-ImageBase+SectionAlignment-1)/SectionAlignment*SectionAlignment
BaseOfData==VBaseOf_idat
@=ImageBase+VBaseOf_idat
; Insert initialized variables here (and set UseIdatSection=1
; at the top of this file). Because the code section is set
; r/w-able, you can put initialized variables also into the
; code section.
; var1: dc.l 0
; var2: dc.l $12345678
VSizeOf_idat==@-Imagebase-VBaseOf_idat
@a=@
evencom FileAlignment
@=@a
FSizeOf_idat==@@-FBaseOf_idat
; +--------------------------------------------+
; | End of .idat Section |
; +--------------------------------------------+
SizeOfInitializedData==FSizeOf_idat
; +--------------------------------------------+
; | Start of .udat Section |
; +--------------------------------------------+
FBaseOf_udat==@@
VBaseOf_udat==(@-ImageBase+SectionAlignment-1)/SectionAlignment*SectionAlignment
@=ImageBase+VBaseOf_udat
; Insert uninitialized variables here (and set UseUdatSection=1
; at the top of this file). Because the code section is set
; r/w-able, you can put uninitialized variables also at the END
; of the code section.
; buf1: blk.l 10
; buf2: blk.l 200
VSizeOf_udat==@-Imagebase-VBaseOf_udat
@a=@
evencom FileAlignment
@=@a
FSizeOf_udat==@@-FBaseOf_udat
; +--------------------------------------------+
; | End of .udat Section |
; +--------------------------------------------+
SizeOfUninitializedData==VSizeOf_udat
SizeOfImage==(@-ImageBase+SectionAlignment-1)/SectionAlignment*SectionAlignment
;#==================================================================#
;# End of Sections #
;#==================================================================#