I extracted the linux executable and was surprised to find that both readelf and objdump choke on it despite it loading and running correctly. Some investigation reveals that the name of the dynamic linker was shoved into the "unused" fields in the PT_DYNAMIC header entry to save space:
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
INTERP 0x0000000000000088 0x0000000000010088 0x0000000000010088
0x000000000000001c 0x000000000000001c 0x0
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
DYNAMIC 0x00000000000000e0 0x00000000000100e0 0x6c2f343662696c2f <-- "/lib64/ld-linux-x86-64.so.2"
0x2d78756e696c2d64 0x732e34362d363878 0x322e6f
readelf: Error: the dynamic segment offset + size exceeds the size of the file
LOAD 0x0000000000000000 0x0000000000010000 0x0000000000000000
0x0000000000001dc0 0x0000000000005660 RWE 0x1000
Two questions:
1. Was this done manually or is there a tool you're using which does this? I see other size-reduction tricks in here as well.
2. Does anybody know of a tool for examining executables which doesn't crap out on binaries like this?
On a related note -- when I see the minuscule filesize of the original Zelda game on emulators, I marvel at how little text/code/information could produce how much wonder, how far-reaching impact, and how many hours of enchantment for me.
That honestly doesn't seem too bad. Zelda 1 is relatively large but it reuses a lot of assets and honestly probably doesn't have that much text. (More than a Mario but way less than a Dragon Warrior.)
- Linux: "./snake.com: line 20: lzma: command not found". Installing the xz package makes it work (already had XWayland enabled so X11 worked, but may be needed if you have a strict Wayland session).
- Windows: As either .com or renaming to .exe I get "The application was unable to start correctly (0xc0000005). Click OK to close the application." Not sure how to make this one work, it's definitely not AV related though (I have that stripped in this sandbox VM).
Edit: Got it working in all 3 now. On Windows I still had DEP enabled on all programs to test some apps earlier, turning that back off allowed it to launch.
Hmm, Windows 11 25H2 here as well. Redbean works so there must be something about this particular approach combined with some unknown setting on my install.
If you mean lzma it wasn't immediately apparent to me it was a binary requirement, but inspecting the hex dump at the end + the message is how I figured out it was. I wonder how much space you lose dropping lzma and doing some other method as "tail -c+4294 $0|head -c 5061|lzma -dc>/tmp/a;chmod +x /tmp/a;(/tmp/a&rm /tmp/a);exit" would be more universal and the linux portion isn't all that big.
If you mean the .html rename or whatever my Windows problem was, I must be missing it. Edit: Windows was DEP.
Semi-related: Windows EXE files are runnable in DOS (at least when DOS was a thing, so for Windows 3.1x or 9x), but most of the time the DOS part just prints "This program requires Microsoft Windows." and exits. An exception is regedit.exe, that one can use to import registry values even in DOS. (Huh, although, how does it do that without using Windows API?)
This might have changed at some point. I was curious about the latter part of your question on how it made changes without the Windows API (I assumed it used an older DOS API), but my `regedit.exe` _does_ have the `This program cannot be run in DOS mode.` DOS stub in it.
I love the idea of applications which exist in one file which you can run anywhere. I've been working towards this with my serverless platform; you can build complex data-driven apps with just one .html file and mostly declarative HTML markup (thanks to web-components which are loaded from a remote server). With modern browser features, you don't need a bundling system. Once you do away with it; a whole universe is opened up.
The ability to load .html files over the file:// protocol is a powerful, often neglected feature. In practice, it means you can double-click an HTML file and it runs an app in your browser instantly.
Now I wonder when the first polyglot file was published. I kinda just assumed they'd been around forever. EICAR.COM comes to mind as a COM/plaintext polyglot
sure but they have a blog and a webserver that's serving html. just put the .html version there so i dont have to download anything or mess about too much. just want to click and see it
I think you can use something similar to get the entire page contents as a blob, but I never tested with binary data in actual browsers. Perhaps even patch it to avoid the initial windows error.
1. Was this done manually or is there a tool you're using which does this? I see other size-reduction tricks in here as well.
2. Does anybody know of a tool for examining executables which doesn't crap out on binaries like this?
https://en.wikipedia.org/wiki/The_Legend_of_Zelda_(video_gam...
- Browser: works after renaming to .html
- Linux: "./snake.com: line 20: lzma: command not found". Installing the xz package makes it work (already had XWayland enabled so X11 worked, but may be needed if you have a strict Wayland session).
- Windows: As either .com or renaming to .exe I get "The application was unable to start correctly (0xc0000005). Click OK to close the application." Not sure how to make this one work, it's definitely not AV related though (I have that stripped in this sandbox VM).
Edit: Got it working in all 3 now. On Windows I still had DEP enabled on all programs to test some apps earlier, turning that back off allowed it to launch.
Edit: Got it working, was DEP.
That's because of the binfmt handler that Mono installs which matches the PE header.
If you mean the .html rename or whatever my Windows problem was, I must be missing it. Edit: Windows was DEP.
https://web.archive.org/web/20100304155706/http://www.thepro...
This might have changed at some point. I was curious about the latter part of your question on how it made changes without the Windows API (I assumed it used an older DOS API), but my `regedit.exe` _does_ have the `This program cannot be run in DOS mode.` DOS stub in it.
The ability to load .html files over the file:// protocol is a powerful, often neglected feature. In practice, it means you can double-click an HTML file and it runs an app in your browser instantly.
https://developer.mozilla.org/en-US/docs/Web/Security/Defens...
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
The security risk : https://www.mozilla.org/en-US/security/advisories/mfsa2019-2...
You need a local webserver. Or bundle everything in one html file.
You could distribute it as `.html` only, and use JS to offer a local download link to itself in the correct extension. A polyglot installer, of sorts.
For example, this gist is an HTML that, when opened, offers a download zip of its DOM in whatever state it currently is:
https://gist.github.com/alganet/c904acb57282402fc0bd724f1eeb...
I think you can use something similar to get the entire page contents as a blob, but I never tested with binary data in actual browsers. Perhaps even patch it to avoid the initial windows error.