News for hackers. Stuff that matters.

A comment on Show HN: Tiny 1k Rust binary on Windows. Parent comment

Re:Show HN: Tiny 1k Rust binary on Windows by ChrisSD on Tuesday December 01, 2020 @12:51PM (#25267661)
The Win32 loader will always load kernel32 no matter what. You don't even need it in your import table. It's just a matter of finding where it's loaded and calling into the right functions.
[ Parent | on HN ]
Re:Show HN: Tiny 1k Rust binary on Windows by mcountryman on Tuesday December 01, 2020 @04:00PM (#25269838)
Between a 40b strcmp method (If I had/if it was more widely supported I could use sse4.2 strcmp) and ~74b of resolving said exports a couple syscalls sounds pretty nice provided the context switch isn't more expensive than resolving the imports.
[ Parent | on HN ]
Re:Show HN: Tiny 1k Rust binary on Windows by ChrisSD on Tuesday December 01, 2020 @04:51PM (#25270453)
Well if you really want to you can get the output handle from the PEB[0]. You can then call NtWriteFile[1] using syscall `0x0008` (Windows 10 x64 only)[2].

[0]: https://processhacker.sourceforge.io/doc/struct___r_t_l___u_...

[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/dd...

[2]: https://j00ru.vexillium.org/syscalls/nt/64/

[ Parent | on HN ]
Re:Show HN: Tiny 1k Rust binary on Windows by mcountryman on Wednesday December 02, 2020 @04:31PM (#25281912)
I completely forgot stdout handle is in the PEB! Thanks! After learning how the windows x64 syscall calling convention works I got it working on win10.

https://i.imgur.com/ErHU7Kr.png https://github.com/mcountryman/min-sized-rust-windows/commit...

[ Parent | on HN ]