label inside instruction

Index > Main > label inside instruction

Author

Thread

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 08:57

is it possible to do something like this

Code:

push 12345678, my_value = $-4

in a single line?

19 Jun 2015, 08:57

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 09:44

Only with a macro.

19 Jun 2015, 09:44

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 09:47

thats fine, if i only knew how to make one D:

19 Jun 2015, 09:47

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 10:16

Code:

macro push value,instr {
  push value
  instr
}

19 Jun 2015, 10:16

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 12:17

i think il just write it in 2 lines cause i would need to make one macro for push, other for call, jmp, jne... too many lol

i guess there is not other way to do it

thanks anyways Very Happy

edit: is it possible to get the size of an instruction or the address of the next instruction?

19 Jun 2015, 12:17

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 12:31

Code:

this: nop
next:
size = next-this

19 Jun 2015, 12:31

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 12:47

Code:

call near next_instr
my_address = $-4 
next_instr = $

but wouldnt there be a way to make it more compact without using so many lines? Very Happy

19 Jun 2015, 12:47

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 12:51

randomdude wrote:

Code:
call near next_instr
my_address = $-4 
next_instr = $    
but wouldnt there be a way to make it more compact without using so many lines?

Yes, use a macro.

19 Jun 2015, 12:51

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 12:53

but i would need to create one macro for each instruction lol fasm is driving me crazy

19 Jun 2015, 12:53

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 12:58

I wonder if you are doing something in a terribly bad way. Perhaps if you explained what you are trying to achieve someone can help you find a better way?

19 Jun 2015, 12:58

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 13:21

yes, i have the same feeling Very Happy

im basically making a dll for a game, that patches some addresses and/or creates some codecaves

since my dll has relocations, i cant simply put a 'jmp x' at the end of my codecaves. till now i had to use the following:

Code:

jmp dword[jump_back]
...
dd jump_back dd 0x12345678

but obviously 'jmp dword[pointer_to_x]' wastes more space and is slower, so im looking for a better alternative

the method im currently using, is to patch the jmp's of my own dll, but im unsure which would be most practical way to do it

Description:		Download
Filename:	exdat.zip
Filesize:	885 Bytes
Downloaded:	640 Time(s)

19 Jun 2015, 13:21

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 13:27

How do you know that "jmp dword[pointer_to_x]" is slower? Slower than what?

19 Jun 2015, 13:27

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 13:34

pointer_to_0x12345678 dd 0x12345678
jmp dword[pointer_to_0x12345678]

slower than

jmp 0x12345678

well, at least it uses more space for sure Very Happy

something like this (but taht actually works lol) would make my sourcecode more clear

jmp absolute 0x12345678, JumpBack0 = $-4

with absolute i mean it would generate the relative opcode E9, but followed by 78 56 34 12 isntead of letting fasm calculate the relative value to address 0x12345678

19 Jun 2015, 13:34

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 13:45

randomdude wrote:

pointer_to_0x12345678 dd 0x12345678
jmp dword[pointer_to_0x12345678]

slower than

jmp 0x12345678

This is not guaranteed.

You might be trying to solve a problem that doesn't exist.

Do you know the adage "Get it working, then get it fast"?

19 Jun 2015, 13:45

randomdude

Joined: 01 Jun 2012
Posts: 83

randomdude 19 Jun 2015, 14:06

how reading a value from memory can be as fast as reading it from immediate? but anyways, thats not the point. i just want to write my patches just like if i were patching them directly over the exe, but in asm, not machine code lol

19 Jun 2015, 14:06

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20761
Location: In your JS exploiting you and your system

revolution 19 Jun 2015, 14:09

randomdude wrote:

how reading a value from memory can be as fast as reading it from immediate?

Caches, buffers, predictors, etc. The CPUs are very complex and sometimes the timing of things can be unintuitive. Only comparative testing on the target system can properly answer the "which is fastest?" question.

19 Jun 2015, 14:09

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum