今天突然想到见过别人用vc写的木马 下载者之类大小都只有 几K (没用过pe压缩程序)
我写个hello world用 release + minimize size 编译都有30++k
于是google寻求解答 搜索了一些相关信息 有效的做个总结如下
#include <windows.h>
//自定义加载的库
#pragma comment(lib,"kernel32.lib")
#pragma comment(lib,"shell32.lib")
#pragma comment(lib,"msvcrt.lib")
//自定义函数入口
#pragma comment(linker, "/ENTRY:EntryPoint")
//自定义对齐方式
#pragma comment (linker, "/ALIGN:512")
#pragma comment(linker, "/FILEALIGN:512")
// 优化选项
#pragma comment(linker, "/opt:nowin98")
#pragma comment(linker, "/opt:ref")
#pragma comment (linker, "/OPT:ICF")
// 合并区段
#pragma comment(linker, "/MERGE:.rdata=.data")
#pragma comment(linker, "/MERGE:.text=.data")
#pragma comment(linker, "/MERGE:.reloc=.data")
int WINAPI WinMain( HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int iCmdShow ) ;
void EntryPoint()
{
ExitProcess(WinMain(GetModuleHandle(NULL), NULL,
GetCommandLine(), SW_SHOWNORMAL));
}
/
写了下段代码编译后1K
用peid查看不是vc6.0 而是First Publisher Graphics format *
也不了解pe 只能先这样了 最近时间要学习下相关的知识
![None.gif](/Images/OutliningIndicators/None.gif)
2
![None.gif](/Images/OutliningIndicators/None.gif)
3
![None.gif](/Images/OutliningIndicators/None.gif)
4
![None.gif](/Images/OutliningIndicators/None.gif)
5
![None.gif](/Images/OutliningIndicators/None.gif)
6
![None.gif](/Images/OutliningIndicators/None.gif)
7
![None.gif](/Images/OutliningIndicators/None.gif)
8
![None.gif](/Images/OutliningIndicators/None.gif)
9
![None.gif](/Images/OutliningIndicators/None.gif)
10
![None.gif](/Images/OutliningIndicators/None.gif)
11
![None.gif](/Images/OutliningIndicators/None.gif)
12
![None.gif](/Images/OutliningIndicators/None.gif)
13
![None.gif](/Images/OutliningIndicators/None.gif)
14
![None.gif](/Images/OutliningIndicators/None.gif)
15
![None.gif](/Images/OutliningIndicators/None.gif)
16
![None.gif](/Images/OutliningIndicators/None.gif)
17
![None.gif](/Images/OutliningIndicators/None.gif)
18
![None.gif](/Images/OutliningIndicators/None.gif)
19
![None.gif](/Images/OutliningIndicators/None.gif)
20
![None.gif](/Images/OutliningIndicators/None.gif)
21
![None.gif](/Images/OutliningIndicators/None.gif)
22
![None.gif](/Images/OutliningIndicators/None.gif)
23
![None.gif](/Images/OutliningIndicators/None.gif)
24
![None.gif](/Images/OutliningIndicators/None.gif)
25
![None.gif](/Images/OutliningIndicators/None.gif)
26
![None.gif](/Images/OutliningIndicators/None.gif)
27
![None.gif](/Images/OutliningIndicators/None.gif)
28
![ExpandedBlockStart.gif](/Images/OutliningIndicators/ExpandedBlockStart.gif)
![ContractedBlock.gif](/Images/OutliningIndicators/ContractedBlock.gif)
![dot.gif](/Images/dot.gif)
29
![InBlock.gif](/Images/OutliningIndicators/InBlock.gif)
30
![InBlock.gif](/Images/OutliningIndicators/InBlock.gif)
31
![ExpandedBlockEnd.gif](/Images/OutliningIndicators/ExpandedBlockEnd.gif)
32
![None.gif](/Images/OutliningIndicators/None.gif)
33
![None.gif](/Images/OutliningIndicators/None.gif)
34
![None.gif](/Images/OutliningIndicators/None.gif)
35
![None.gif](/Images/OutliningIndicators/None.gif)
36
![ExpandedBlockStart.gif](/Images/OutliningIndicators/ExpandedBlockStart.gif)
![ContractedBlock.gif](/Images/OutliningIndicators/ContractedBlock.gif)
![dot.gif](/Images/dot.gif)
37
![InBlock.gif](/Images/OutliningIndicators/InBlock.gif)
38
![InBlock.gif](/Images/OutliningIndicators/InBlock.gif)
39
![ExpandedBlockEnd.gif](/Images/OutliningIndicators/ExpandedBlockEnd.gif)
遇到的一些问题 就是编译可以通过但有2个警告还需要解决下
对pe的结构还不是很了解 用uedit32看了下 还有很多00 不知道是不是还有压缩的空间
实现同样功能用masm32写的会小很多
这些选项也没有研究的很透 肯定还存在问题 这里先留个帖子 以后改进了弄明白了再来修改