recalculating the checksum in a 64 bit windows executable

[a***@spenarnc.xs4all.nl]

It is comparatively easy to grow a windows 64 bit excitable
to allow more dictionary space. To do it properly one has to adjust
the redundancy check, that is a summation of 16 bit entities to which
is added the file length, generating 32 bits.

The following code is doing that:
(lina is a 64 bit windows Forth )

\ -------------------- 8< ----------------------------
#!/usr/bin/lina -s
\ Correct the checksum in the 64 bit executable in the first argument.
WANT -ROT $-PREFIX BOUNDS H. DUMP /STRING
: W@ @ $FFFF AND ; \ Intel only!
1 ARG[] GET-FILE .S
\ 0 , DUP 1 AND + \ make it even
OVER CONSTANT FILE
FILE 2 + W@ FILE + CONSTANT PE-header
PE-header 100 DUMP
PE-header 88 + CONSTANT checksum
\ PE-header FILE - /STRING
checksum L@ H.
0 checksum L!
2DUP 0 -ROT BOUNDS .S DO I W@ + 2 +LOOP .S
BEGIN DUP $FFFF > WHILE $10000 /MOD + REPEAT .S
\ INVERT $FFFF AND
OVER + .S checksum L! .S
1 ARG[] PUT-FILE
\ -------------------- 8< ----------------------------
The offsets 2 and 88 are found in
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format

There is an issue at stack overflow "Windows PE checksum algorithm"
with obscure java python c# code. The actual code is
"BOUNDS DO I W@ + 2 +LOOP "
followed by folding the overflowing bits into 16 bits.
"BEGIN DUP $FFFF > WHILE $10000 /MOD + REPEAT"


Correct checksums can become in issue in DLL's, Microsoft promises
to kill offending DLL's not so for executables.
wine doesn't care for my windows 32 or 64 bits executable.

One can now patch the filesize in the COFF header, and expand the
dictionary space from 4 megabyte to 1 megabyte and have a correct
header.

Groetjes

[mhx]

Post by a***@spenarnc.xs4all.nl
\ -------------------- 8< ----------------------------
#!/usr/bin/lina -s
\ Correct the checksum in the 64 bit executable in the first argument.
WANT -ROT $-PREFIX BOUNDS H. DUMP /STRING
1 ARG[] GET-FILE .S
\ 0 , DUP 1 AND + \ make it even
OVER CONSTANT FILE
PE-header 100 DUMP
PE-header 88 + CONSTANT checksum

[..]

This is a script? Why does it have the " .S " and " DUMP " in it?
Or is " #!/usr/bin/lina " a Forth word?

-marcel

[dxf]

Post by a***@spenarnc.xs4all.nl
...
Correct checksums can become in issue in DLL's, Microsoft promises
to kill offending DLL's not so for executables.

Same for MS-DOS 'MZ' executables. There's a 16-bit field in the
header for a checksum apparently unused.

Post by a***@spenarnc.xs4all.nl
wine doesn't care for my windows 32 or 64 bits executable.

By name and by nature?

"Wine Is Not an Emulator"