Win32 PE, ImageHlp, and Checksum (CRC)

Hi All,

To cut to the Chase: What is the Algorithm that Microsoft uses for the
PE checksum?

I'm researching shortcomings of the Windows Checksum in the Header.
Using ImageHlp I can extract the embedded checksum and have the file's
checksum recalculated.

I've used IDA Pro to perform a statc listing: CheckSumMappedFile()
from ImageHlp.dll eventually calls _ChkSum@12. So the function is
there.

I've also notice that Microsoft only uses the low order 24 bits of the
DWORD, so I suspect one of two things:

* CRC-24 or variant
* CRC-32 with some sort of truncation

I'm also aware most bets are off with .NET when using Cetificates to
verify the image's integrity.

Any Ideas,
Jeff
Jeffrey Walton

So far, I've looked at:
* Microsoft PE Executable Format
* Debbuging Applications, 1st Ed (John Robbins)
* Debbuging Applications, 3rd Ed (John Robbins)
* MSJ Under the Hood by Matt Pietrek
* An In-Depth Look into the Win32 Portable
Executable File Format, Part 1
* An In-Depth Look into the Win32 Portable
Executable File Format, Part 2
* What Goes On Inside Windows 2000: Solving the
Mysteries of the Loader
* Undocumented DOS (Personal Library)
* Undocumented Windows 2000 Secrets (Personal Library)
* Web Grep

.

Relevant Pages

  • Re: Alert: Microsoft Security Bulletin - MS03-013 - Windows 2000 Warning
    ... 0x00D8-0x00DB, which is where the timestamp is stored in the file header, ... which is the image checksum. ... Subject: Alert: Microsoft Security Bulletin - MS03-013 - Windows 2000 ... If Microsoft has somehow fixed the problems with MS03-007, ...
    (NT-Bugtraq)
  • RE: Blue Screen stop: c0000221
    ... C0000221 {Bad Image Checksum} The image SHDOCVW.dlll is possibly corrupt. ... I have tried to start in safe mode, ... Insert the Windows XP CD into your CD-ROM or DVD-ROM drive. ...
    (microsoft.public.windowsxp.general)
  • BAD TCP CHECKSUM over PPP
    ... from Windows machine to the linux server. ... I am seeing lots of Incorrect TCP Checksum packets on ...
    (Linux-Kernel)
  • Re: BLUE STOP SCREENS
    ... Description of Windows XP and Windows Server 2003 System File ... To run sfc / scannow you need a Window XP CD which includes the SP2 ... 3--STOP: c0000221 {Bad Image Checksum} ... to restart in safe mode. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Win32 PE, ImageHlp, and Checksum (CRC)
    ... What is the Algorithm that Microsoft uses for the ... I'm researching shortcomings of the Windows Checksum in the Header. ... Executable File Format, Part 1 ...
    (microsoft.public.win32.programmer.kernel)
Loading