Skip to content

Instantly share code, notes, and snippets.

@BeRo1985
Last active August 29, 2015 14:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save BeRo1985/0104970a76af7a66a747 to your computer and use it in GitHub Desktop.
Save BeRo1985/0104970a76af7a66a747 to your computer and use it in GitHub Desktop.
ASM dot vs. non-dot per directive
;======================================================================
; With dot per directive
;======================================================================
.macro CopyData(Src, Dest, Count, UseRep){
.local Temp
cld
mov esi, Src
mov edi, Dest
.if(UseRep){
mov ecx, Count
push ecx
shr ecx, 2
rep movsd
pop ecx
and ecx, 3
rep movsb
}else{
Temp = __integer__(Count)
.while(Temp > 0){
.if(Temp > 3){
movsd
Temp = Temp - 4
}else{
movsb
Temp = Temp - 1
}
}
}
}
CopyData [Source], [Dest], 0x1000, 0
CopyData [Source], [Dest], 1000h, 1
.library "kernel32.dll"
.import ExitProcess,"ExitProcess"
;======================================================================
; Without dot per directive
;======================================================================
macro CopyData(Src, Dest, Count, UseRep){
local Temp
cld
mov esi, Src
mov edi, Dest
if(UseRep){
mov ecx, Count
push ecx
shr ecx, 2
rep movsd
pop ecx
and ecx, 3
rep movsb
}else{
Temp = __integer__(Count)
while(Temp > 0){
if(Temp > 3){
movsd
Temp = Temp - 4
}else{
movsb
Temp = Temp - 1
}
}
}
}
CopyData [Source], [Dest], 0x1000, 0
CopyData [Source], [Dest], 1000h, 1
library "kernel32.dll"
import ExitProcess,"ExitProcess"
;======================================================================
; With dot per directive
;======================================================================
.target pe32 (imagebase = 0x400000, codebase = 0x1000, subsystem = gui, executable)
.cpu all
.bits 32
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Zweite Makroassembler-Syntax Ebene mit JavaScript ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
.javascript {
Macro.invoke = function(){
// 32-bit x86 stdcall invoke
var functionName = arguments[0];
for(var i = arguments.length - 1; i > 1; i--){
var functionParameter = arguments[i];
Assembler.parse("push "+functionParameter);
}
Assembler.parse("call dword ptr ["+functionName+"]");
}
Functions.replaceEAXwithEBX = function(asm){
Assembler.parse(asm.replace("eax","ebx"));
}
}
.javascript.replaceEAXwithEBX {
xor eax,eax
add eax,123
push eax
pop eax
}
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Erste Makroassembler-Syntax Ebene a la MASM/FASM/TASM ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
invoke MessageBox,byte 0,dword Text,dword Title,byte 0
invoke ExitProcess,byte 0
Title: db "Title"
Text: db "Hello world!"
.library "kernel32.dll"
.import ExitProcess "ExitProcess"
.import GetModuleHandle "GetModuleHandleA"
.library "user32.dll"
.import MessageBox "MessageBoxA"
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
a = "Hallo "
c = "grosse "
b = "liebe " + c
db a + b + "Erde\r\n", 0
pi = 3.14159
dd pi * 2.0 ; <= 6.26318
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
e = 4
lea eax,[(eax-eax)+(eax*1)+ebx*e] ; <= mov eax,[eax+ebx*4]
Dest equ eax
mov Dest,dword [Dest] ; <= mov eax,dword [eax]
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
a = 123
.if(a == 123){
invoke MessageBox,byte 0,dword Text,dword Title,byte 0
invoke ExitProcess,byte 0
}else if(a == "EinString"){
.while(a > 0){
db a
a = a - 1
}
}else if(pi == 3.14159){
times 1337 db 0x1337c0d3
}else{
db 1337 dup (0x1337c0d3)
}
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
.macro GDT(gdtLimit,gdtBase_00_15,gdtBase_16_23,gdtType,gdtMisc,gdtBase_24_31){
dw gdtLimit
dw gdtBase_00_15
db gdtBase_16_23
db gdtType
db gdtMisc
db gdtBase_24_31
}
.align 4
GDTRTable:
dw (offset GDTRTableEnd)-((offset GDTRTable)+1)
GDTRBase: dw offset GDTRTable,0
dw 0
GDTR_CODE16: GDT 0xFFFF,0,0,0x9B,0x00,0
GDTR_DATA16: GDT 0xFFFF,0,0,0x93,0x00,0
GDTR_CODE32_Ring0: GDT 0xFFFF,0,0,0x9B,0xCF,0
GDTR_DATA32_Ring0: GDT 0xFFFF,0,0,0x93,0xCF,0
GDTR_CODE32_Ring3: GDT 0xFFFF,0,0,0xFB,0xCF,0
GDTR_DATA32_Ring3: GDT 0xFFFF,0,0,0xF3,0xCF,0
GDTR_TSS: GDT 0xFFFF,0,0,0x89,0x00,0
GDTR_TIB: GDT 0xFFFF,0,0,0x93,0xCF,0
GDTRTableEnd:
;times 32-2 dd 0x90909090
IDTTable: times 2 dd 0x90909090
IDT16Table:
dw 0x3ff
dd 0
dd 0
BootDrive: db 0
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
PEEXEMAGIC=0x00004550
PECPU386=0x14C
PECPU486=0x14D
PECPU586=0x14E
.struct TPEEXEHeader {
Signature dword(1)
CPUType word(1)
ObjectCount word(1)
TimeStamp dword(3)
NTHeaderSize word(1)
Flags word(1)
OptionalStart dword(4)
EntryPointRVA dword(1)
Reserved dword(2)
ImageBase dword(1)
ObjectAlign dword(1)
FileAlign dword(1)
VersionInfo word(8)
ImageSize dword(1)
HeaderSize dword(1)
CheckSum dword(1)
SubSys word(1)
DLLFlags word(1)
StackReserve dword(1)
StackCommit dword(1)
HeapReserve dword(1)
HeapCommit dword(1)
Fill dword(1)
RVAs dword(1)
ExportRVA dword(1)
ExportSize dword(1)
ImportRVA dword(1)
ImportSize dword(1)
ResourceRVA dword(1)
ResourceSize dword(1)
ExceptionRVA dword(1)
ExceptionSize dword(1)
SecurityRVA dword(1)
SecuritySize dword(1)
RelocationRVA dword(1)
RelocationSize dword(1)
DebugRVA dword(1)
DebugSize dword(1)
ImageDescRVA dword(1)
ImageDescSize dword(1)
MachineRVA dword(1)
MachineSize dword(1)
TLSRVA dword(1)
TLSSize dword(1)
}
.struct TPEEXESectionHeader {
Name byte(8)
VirtualSize dword(1)
RVA dword(1)
PhysicalSize dword(1)
PhysicalOfs dword(1)
Reserved dword(3)
Flags dword(1)
}
.struct TPEEXERelocation {
PageRVA dword(1)
BlockSize dword(1)
}
.smartlink LoadPEEXE {
push ebx
push ecx
push esi
; eax = pe header
; esi/ebx = mzexe header
mov esi,ebx
mov eax,ebx
add eax,dword [eax+0x3c]
; clear memory
push eax
push edi
mov ecx,dword ptr [eax+TPEEXEHeader.ImageSize]
xor eax,eax
push ecx
shr ecx,2
rep stosd
pop ecx
and ecx,0x3
rep stosb
pop edi
pop eax
; copy pe image heeder
push esi
push edi
mov ecx,dword ptr [eax+TPEEXEHeader.HeaderSize]
push ecx
shr ecx,2
rep movsd
pop ecx
and ecx,0x3
rep movsb
pop edi
pop esi
movzx ecx,word ptr [eax+TPEEXEHeader.ObjectCount]
movzx ebx,word ptr [eax+TPEEXEHeader.NTHeaderSize]
lea ebx,[ebx+eax+TPEEXEHeader.OptionalStart]
; copy sections
LoadPEEXECopySectionLoop:
push ecx
push esi
push edi
add esi,dword ptr [ebx+TPEEXESectionHeader.PhysicalOfs]
add edi,dword ptr [ebx+TPEEXESectionHeader.RVA]
mov ecx,dword ptr [ebx+TPEEXESectionHeader.PhysicalSize]
push ecx
shr ecx,2
rep movsd
pop ecx
and ecx,0x3
rep movsb
pop edi
pop esi
pop ecx
add ebx,TPEEXESectionHeader
dec ecx
jnz short LoadPEEXECopySectionLoop
mov eax,dword ptr [eax+TPEEXEHeader.EntryPointRVA]
pop esi
pop ecx
pop ebx
push ebx
mov ebx,edi
call loadPERelocate
add eax,ebx
pop ebx
ret
;--- subroutine
loadPERelocate:
pushad
mov edi,ebx
add edi,dword [edi+0x3c]
mov edx,ebx
sub edx,dword ptr [edi+TPEEXEHeader.ImageBase]
mov dword ptr [edi+TPEEXEHeader.ImageBase],ebx
mov esi,dword ptr [edi+TPEEXEHeader.RelocationRVA]
test esi,esi
jz short LoadPERelocateDone
mov ecx,dword ptr [edi+TPEEXEHeader.RelocationSize]
jecxz LoadPERelocateDone
LoadPERelocateMore:
mov ebp,dword ptr [ebx+esi+TPEEXERelocation.PageRVA]
mov ecx,dword ptr [ebx+esi+TPEEXERelocation.BlockSize]
jecxz LoadPERelocateDone
sub ecx,TPEEXERelocation
add esi,TPEEXERelocation
LoadPERelocateNext:
movzx eax,word ptr [ebx+esi]
mov edi,eax
and edi,0xfff
add edi,ebp
shr eax,12
dec eax
jz short LoadPERelocateHigh
dec eax
jz short LoadPERelocateLow
dec eax
jz short LoadPERelocateHighLow
dec eax
jz short LoadPERelocateHighAdj
jmp short LoadPERelocateSkip
LoadPERelocateHigh:
push edx
shr edx,16
add word ptr [ebx+edi],dx
pop edx
jmp short LoadPERelocateSkip
LoadPERelocateLow:
add word ptr [ebx+edi],dx
jmp short LoadPERelocateSkip
LoadPERelocateHighLow:
add dword ptr [ebx+edi],edx
jmp short LoadPERelocateSkip
LoadPERelocateHighAdj:
add esi,2
sub ecx,2
mov eax,dword ptr [ebx+edi-2] ; lo hi (little endian)
; or to be absolute safe:
; mov ax,word ptr [ebx+edi]
; shl eax,16
mov ax,word ptr [ebx+esi]
lea eax,[eax+edx+0x8000]
shr eax,16
mov word ptr [ebx+edi],dx
LoadPERelocateSkip:
add esi,2
sub ecx,2
jnz short LoadPERelocateNext
jmp short LoadPERelocateMore
LoadPERelocateDone:
clc
popad
ret
}
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
.target mz (stack = 0x8000, heap = 0x0, startoffset = 0x100, entrypoint = StartLabel)
.cpu 386
.segment CodeSegment use16
StartLabel:
mov ax,seg16 DataSegment
mov ds,ax
mov byte ptr ds:[ofs16 TestData],al
call seg16 DummyFunc:ofs16 DummyFunc ; the preferred and correct way
call seg16 LibrarySegment:ofs16 DummyFunc ; also a correct way, but not the preferred way, because of possible mistake cases
call (LibrarySegment >> 4):ofs16 DummyFunc ; the wrong way, because no MZEXE relocation entries will be generated in this case
call (LibrarySegment >> 4):(DummyFunc-LibrarySegment) ; again, the wrong way, because no MZEXE relocation entries will be generated in this case
call seg16 ExitToDOS:ofs16 ExitToDOS
.segment LibrarySegment use16
DummyFunc:
retf
ExitToDOS:
mov ah,0x4c
int 21h
.segment DataSegment
TestData: db 1,2,3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment