flat assembler - RB directive - Reserved Data (was "Reverse Data?")

Index > Main > RB directive - Reserved Data (was "Reverse Data?")

Author

Thread

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 15:03

Code:

example rb 1024

What is reverse data?
Why should I use it?
When should I use it?

Thank you.

(PS: My Antivir alerts for virus when I try to compile some amount of reverse data (like more than 60 bytes)).

EDIT by DOS386 : corrected and enhanced subject

_________________
Sorry if bad english.

27 Dec 2009, 15:03

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 15:14

rb - reserve byte(s)

PS: Time to delete your AV

27 Dec 2009, 15:14

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 15:20

revolution wrote:

rb - reserve byte(s)

Yeh, I just want to know 'why' and 'when'. Smile

Quote:

PS: Time to delete your AV

lol revolution, you already said that to me before, haha. But there is something wrong, bc some apps have reverse data and my antivir doesn't alerts. Only if I compile it alerts Confused

_________________
Sorry if bad english.

27 Dec 2009, 15:20

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 15:26

reserve, not "reverse". Do you see the difference?

27 Dec 2009, 15:26

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 15:28

You reserve space in your code or data. Presumably to put something there later at runtime.

27 Dec 2009, 15:28

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 15:32

OMG, i did read everything wrong all times. Shocked

Sorry

_________________
Sorry if bad english.

27 Dec 2009, 15:32

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 15:37

man, I can't believe that! wow...

please delete this topic, i feel ashamed. lol haha

27 Dec 2009, 15:37

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 15:42

Must have been a brain fart.

27 Dec 2009, 15:42

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 17:40

oh well..

Code:

example rb 10

Code:

example db 10 dup ?

27 Dec 2009, 17:40

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 18:11

Quote:

(PS: My Antivir alerts for virus when I try to compile some amount of reverse data (like more than 60 bytes)).

I found it! When I change sections order the AV alerts Confused

Virus alert:

Code:

format PE GUI 4.0
entry _start

    include 'win32a.inc'

section '.data' data readable writeable ; <- data at top

       example rb 1024  ; !!!!!!!!!!!! virus alert.......... !!!!!!!!!!!!

section '.text' code readable executable

_start:
        invoke  ExitProcess, 0

section '.idata' import data readable writeable

    library kernel32,'KERNEL32.DLL', user32,'USER32.DLL'

    include 'api\user32.inc'
    include 'api\kernel32.inc'

NO virus alert:

Code:

format PE GUI 4.0
entry _start

    include 'win32a.inc'

section '.text' code readable executable

_start:
        invoke  ExitProcess, 0

section '.data' data readable writeable ; <- data at bottom

       example rb 1024  ; !!!!!!!!!!!! NO virus alert.......... !!!!!!!!!!!!

section '.idata' import data readable writeable

    library kernel32,'KERNEL32.DLL', user32,'USER32.DLL'

    include 'api\user32.inc'
    include 'api\kernel32.inc'

27 Dec 2009, 18:11

bitshifter

Joined: 04 Dec 2007
Posts: 796
Location: Massachusetts, USA

bitshifter 27 Dec 2009, 20:18

Also...

Code:

section '.idata' import data readable writeable

No need for writeable there...
Funny that fasm examples have it...

27 Dec 2009, 20:18

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 27 Dec 2009, 20:48

reserve can be used in an uninitialized section to reserve a given memory (but not initialize it to a given value), it's like allocating that memory.

it doesn't take up size in the executable (on the file) apart from telling it how many bytes to reserve.

27 Dec 2009, 20:48

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 21:13

@bitshifter, now you noticed I take the base code from FASM examples (EXAMPLES/TEMPLATE/TEMPLATE.ASM).

Borsuc, good to know that it doesn't increase exe size.

27 Dec 2009, 21:13

windwakr

Joined: 30 Jun 2004
Posts: 827

windwakr 27 Dec 2009, 22:00

Teehee wrote:

@bitshifter, now you noticed I take the base code from FASM examples (EXAMPLES/TEMPLATE/TEMPLATE.ASM).

Borsuc, good to know that it doesn't increase exe size.

It WILL increase file size if you put anything after it.

_________________
----> * <---- My star, won HERE

27 Dec 2009, 22:00

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 27 Dec 2009, 23:05

That's because it will not be put into the uninitialized section anymore.

Right?

27 Dec 2009, 23:05

DOS386

Joined: 08 Dec 2006
Posts: 1900

DOS386 28 Dec 2009, 07:57

bitshifter wrote:

Also...
Code:
section '.idata' import data readable writeable    
No need for writeable there... Funny that fasm examples have it...

Imports in a PE MUST be writable Shocked

but only when loading ... protection is apparently set AFTER hacking the imports Shocked

> reserve can be used in an uninitialized section to reserve a
> given memory (but not initialize it to a given value), it's like
> allocating that memory.

You can avoid rb alltogether (or use it just inside virtual) and hog your memory from the kernel (VirtualAlloc, INT $31, INT $21), or reserve your (not too much) memory on the stack Smile

> (PS: My Antivir alerts for virus when I try to compile some amount
> of reverse data (like more than 60 bytes)).

On the subforum top there is a FAQ having 11 entries about this "problem" ... now 12 Wink

_________________
Bug Nr.: 12345

Title: Hello World program compiles to 100 KB !!!

Status: Closed: NOT a Bug

28 Dec 2009, 07:57

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum