[Code-Crunchers] [funsec] tiny PE now at... 304 bytes. Is this the end? (fwd)

[Peter Ferrie]

Hi Nico,
 
I have the data at the end, everything runs before that.  Maybe I could merge them a little bit better, but I think my short jump won't reach.

________________________________

From: Nicolas Brulez [mailto:n.brulez at free.fr]
Sent: Fri 10/20/2006 6:38 PM
To: Peter Ferrie
Cc: code-crunchers at whitestar.linuxbox.org
Subject: Re: [Code-Crunchers] [funsec] tiny PE now at... 304 bytes. Is this the end? (fwd)



Hey Peter,

Nice to see you :-)
> Remove the ".dll" from "urlmon.dll".  Windows will add it for you.
> There goes 4 more bytes.
>  
Yep, when i did some tests, i wasn't using .dll either.
> The header can be arranged differently to become smaller.
> I am 299 bytes now, but trying to make it better.
Nice :)
You can also play with the last character to be decrypted... if you pick
your key well enough, you have it do an instruction and be the 0 at the
same time (once decrypted).. :-)
To have one less byte..

N.