invoke reg

Index > Main > invoke reg

Author

Thread

AE

Joined: 07 Apr 2022
Posts: 72

AE 11 Apr 2022, 20:20

How to use register as procedure address for invoke?

Code:

invoke r12, arg1

to not get

call[r12]: operand size not specified

And BTW is there a thread for general questions, or is it better to create a topic for each?

11 Apr 2022, 20:20

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20759
Location: In your JS exploiting you and your system

revolution 11 Apr 2022, 20:47

I suspect you want stdcall if r12 is the address of the target, and not a pointer to the address.

11 Apr 2022, 20:47

ProMiNick

Joined: 24 Mar 2012
Posts: 821
Location: Russian Federation, Sochi

ProMiNick 11 Apr 2022, 21:01

If actually invoke reg needed:

Code:

format PE64 GUI 5.0
entry start

include 'win64a.inc'

section '.text' code readable executable

  start:
        sub     rsp,8
        mov     r12,ExitProcess
        virtual at r12
                ExitProcess%% dq ?
        end virtual
        invoke  ExitProcess%%,0

section '.idata' import data readable writeable

  library kernel32,'KERNEL32.DLL'

  include 'os_specs/windows/api/x86/kernel32.inc'

or this

Code:

format PE64 GUI 5.0
entry start

include 'win64a.inc'

virtual at 0
        void dq ?
end virtual

r12.void equ r12+void

section '.text' code readable executable

  start:
        sub     rsp,8
        mov     r12,ExitProcess
        invoke  r12.void,0

section '.idata' import data readable writeable

  library kernel32,'KERNEL32.DLL'

  include 'os_specs/windows/api/x86/kernel32.inc'

that will call qword[r12] - construct questions correctly - or thou will be surprized with answers)

Last edited by ProMiNick on 11 Apr 2022, 21:07; edited 1 time in total

11 Apr 2022, 21:01

AE

Joined: 07 Apr 2022
Posts: 72

AE 11 Apr 2022, 21:04

That's informative, thank you very much!

11 Apr 2022, 21:04

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20759
Location: In your JS exploiting you and your system

revolution 11 Apr 2022, 21:47

A more concise way to achieve the invoke is:

Code:

label q12 qword at r12
invoke q12, arg1, ...

11 Apr 2022, 21:47

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum