Author Topic: PECompact v3.03 beta series has begun  (Read 25001 times)

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
PECompact v3.03 beta series has begun
« on: May 17, 2010, 12:15:47 PM »
The first beta of the v3.03 beta series has been released. Changes thus far are:
  • Fix.core/loaders: Fix of a memory leak on compressed DLLs that are loaded, then freed. Note that the leak will still exist if you use any API hook plug-in because the decompressed loader can't be deallocated since it contains API hook code that may be later referenced.
  • Fix.core: Fixed possible memory corruption on DLLs that support SafeSEH and get relocated (via ASLR or base collision)
  • Addition.core: Added deep delete and/or relocate of LoadConfig directories
  • Addition.core: Added proper SafeSEH and LockTablePrefix support
  • Addition.core: Proper registration of loader exception handler(s) is (created or appended) SafeSEH table
  • Change.GUI: Standardized command line switches, so always 'Y' and 'N' instead of some intermingled 'Yes' and 'No's
  • Fix.EAD.Loader: The Enhanced Anti-Debug Loader could previously wipe out one of the watermarks stored by PEWatermark, causing runtime retrieval of the watermark to fail
« Last Edit: May 19, 2010, 04:54:28 PM by jeremy.collake »


Software Engineer. Bitsum LLC.

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
Re: PECompact v3.03 beta series has begun
« Reply #1 on: May 19, 2010, 04:53:21 PM »
And 3.03.2 beta is here already ... This has an additional fix of a memory leak on compressed DLLs that are loaded, then freed. Note that the leak will still exist if you use any API hook plug-in because the decompressed loader can't be deallocated since it contains API hook code that may be later referenced... A solution to that issue is a little larger, but in cases where no API hook plug-in is used the loader is now deallocated as it should be. This will slightly decrease memory use on compressed EXEs as well.
Software Engineer. Bitsum LLC.

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
Re: PECompact v3.03 beta series has begun
« Reply #2 on: May 20, 2010, 08:27:14 PM »
3.03.3 beta is out, with 3.03.4 on its way.

This update makes a few small changes to the loader(s). Any anti-virus/anti-malware researcher should get up to date. I tried to change as little as possible, and don't plan further changes. Any anti-virus/anti-malware researcher/developer who needs the loader source code should email me at [email protected] . Those who already have the LoaderSDK will get an update when v3.04.0 goes final.
Software Engineer. Bitsum LLC.

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
Re: PECompact v3.03 beta series has begun
« Reply #3 on: May 23, 2010, 07:29:17 PM »
3.03.5 beta fixes a crash when handling certain LoadConfig directories and fixes handling of LoadConfig.SecurityCookie. It is getting there.
Software Engineer. Bitsum LLC.

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
Re: PECompact v3.03 beta series has begun
« Reply #4 on: June 23, 2010, 05:01:13 AM »
3.03.7 beta has been released with the new capability (console only right now) to correctly compress SFX installers and other previously uncompressible files with extra-data appended at the end and referenced at a static physical offset. This is accomplished through API hooks. You have the option to either include the extra-data within the compressed PE image (so its processed through CODECs), or leave it outside the compressed PE image (so it isn't all loaded at once, and instead read from disk as needed). The new switch is /ExtraDataFix:[I/O] . Other switches are not necessary (e.g. /KeepOverlay), and may interfere as this switch will set those setting as needed to perform the operation.

Of course, this is accomplished via API hooks to redirect reads on the host file by the host file to the new location of the overlay.

The Loader SDK has been updated, extending the PEC_HOST_INFO structure by 3 DWORDs to provide 'emulated' overlay/extra-data information.
Software Engineer. Bitsum LLC.

Offline Jeremy Collake

  • Administrator
  • Member#
  • *****
  • Posts: 5130
  • Priority Boosts: 132
  • Gender: Male
  • The Lasso
    • Bitsum
Re: PECompact v3.03 beta series has begun
« Reply #5 on: December 06, 2012, 08:45:46 PM »
PECompact 3.04.01 beta continues this series, a build that is now available. Changes are minor, cosmetic only at this junction.
Software Engineer. Bitsum LLC.