pyasm_example.py

# encoding: utf-8
"""
generate.py
TODO: Description

This program is free software. It comes without any warranty, to
the extent permitted by applicable law. You can redistribute it
and/or modify it under the terms of the Do What The Fuck You Want
To Public License, Version 2, as published by Sam Hocevar. See
http://sam.zoy.org/wtfpl/COPYING for more details.
"""
from pyasm2.x86 import *

class pusha(Instruction):
	_opcode_ = 0x60

class popa(Instruction):
	_opcode_ = 0x61

SZWCHAR = 0x02

entry = Label('entry')
main = Label('main')
next_module = Label('next_module')

code = Block(
	entry,
	mov(eax, dword[esp]),
	ret,

	main,
	push(dword[0xdeadbeef]),
	pushf,
	pusha,
	call(entry),
	add(eax, 0x34),
	push(dword[eax]),
	xor(ecx, ecx),
	mov(esi, [ dword[fs:0x0] + 0x30]),
	mov(esi, dword[ esi + 0x0C ]),
	mov(esi, dword[ esi + 0x1C ]),

	next_module,
	mov(ebp, [ esi + 0x08 ]),
	mov(edi, [ esi + 0x20 ]),
	mov(esi, [ esi ]),
	cmp_([ edi + (12 * SZWCHAR) ], cl),
	jnz(next_module),

	# LoadLibraryW
	mov(edi, dword[ebp]),
	add(edi, dword[0x14913]),
	call(dword[edi]),

	# procrewriter.Initialize
	mov(edi, eax),
	add(edi, dword[0x110ff]),
	call(dword[edi]),

	# Cleanup
	popa,
	popf,
	ret
)

char2hex = lambda c: hex(ord(c))
sc = map(char2hex, code.assemble())
print dir(code)