Some interesting findings about Chicago Build 73(f/g)

Discuss Windows 95, 98 and ME.
Post Reply
roytam1
FTP Access
Posts: 695
Joined: Mon Nov 03, 2008 6:15 am

Some interesting findings about Chicago Build 73(f/g)

Post by roytam1 »

While I'm trying to make my GreenPad text editor working on various windows builds, I found something interesting about Chicago Build 73:

The PE loader of Chicago Build 73(f/g) relies on "Section size in file" in ".bss" section.
normally modern linkers will put a 0 in this field, and normally PE loader will calculate the real size of this section in memory and give correct permissions for read and write.
but Chicago Build 73 doesn't do this but relies on "Section size in file" field instead, while modern linkers put a 0 to this field, Chicago Build 73 will simply not giving this section correct permissions.
As a result, program can't write to its global variables and causing a Page Fault in kernel32.dll every time it tries to access its global variables.

For a fix, I used PE Editor that comes from LordPE suite to edit .bss section header. I also used IDA to further verify the size of .bss section for me to fill the value (with rounding up to next 512 bytes)
and finally my binary is working in Chicago Build 73.
Image

LangsamSpieler
User avatar
FTP Access
Posts: 299
Joined: Sun Apr 16, 2017 4:38 pm
Location: Zurich, Switzerland
Contact:

Re: Some interesting findings about Chicago Build 73(f/g)

Post by LangsamSpieler »

Build 73 (Without Letter at end) is not a Real Build of Microsoft Chicago. See it on BetaWiki.
73f and 73g are the real ones.

roytam1
FTP Access
Posts: 695
Joined: Mon Nov 03, 2008 6:15 am

Re: Some interesting findings about Chicago Build 73(f/g)

Post by roytam1 »

LangsamSpieler wrote:
Wed Jan 04, 2023 7:37 pm
Build 73 (Without Letter at end) is not a Real Build of Microsoft Chicago. See it on BetaWiki.
73f and 73g are the real ones.
the behavior is common for 73f and 73g.
I can suppose it is common for all 73* builds.

roytam1
FTP Access
Posts: 695
Joined: Mon Nov 03, 2008 6:15 am

Re: Some interesting findings about Chicago Build 73(f/g)

Post by roytam1 »

Just find that I don't really need to calculate `SizeOfRawData` by myself, I can just copy `IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData` to it and done!
updated my little PE header utility for this: https://github.com/roytam1/rtoss/commit ... 88fe185f59

DiskingRound
User avatar
FTP Access
Posts: 1524
Joined: Thu May 01, 2014 10:26 pm
Location: Inside the space between . and I

Re: Some interesting findings about Chicago Build 73(f/g)

Post by DiskingRound »

LangsamSpieler wrote:
Wed Jan 04, 2023 7:37 pm
Build 73 (Without Letter at end) is not a Real Build of Microsoft Chicago. See it on BetaWiki.
73f and 73g are the real ones.
73 must have existed. If 34 and 81 exist, there is definitely a 73, then recompiled into 73c, 73d, 73e, 73f, 73g, etc. to fix minor bugs.

Battler
User avatar
Donator
Posts: 2099
Joined: Sat Aug 19, 2006 8:13 am
Location: Slovenia, Central Europe.
Contact:

Re: Some interesting findings about Chicago Build 73(f/g)

Post by Battler »

Not necessarily, especially considering that the only difference between 73f and 73g is that the former is internal while the latter is public.
Main developer of the 86Box emulator.
Join the 86Box Discord server, a nice community for true enthusiasts and 86Box supports!

The anime channel is on the Ring of Lightning Discord server.

Check out our SoftHistory Forum for quality discussion about older software.

roytam1
FTP Access
Posts: 695
Joined: Mon Nov 03, 2008 6:15 am

Re: Some interesting findings about Chicago Build 73(f/g)

Post by roytam1 »

roytam1 wrote:
Thu Jan 05, 2023 3:22 am
Just find that I don't really need to calculate `SizeOfRawData` by myself, I can just copy `IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData` to it and done!
updated my little PE header utility for this: https://github.com/roytam1/rtoss/commit ... 88fe185f59
and off-topic: and this reveals a bug in ReactOS' PE loader component. When `.bss` section's `SizeOfRawData` is not 0, program/library doesn't work correctly.

EDIT: it should be ntoskrnl/mm, created PR for it: https://github.com/reactos/reactos/pull/5002

Post Reply