Damn! I thought the latest alpha could. Though, there was a FASM debugger... FDBG I think, for x64.

       xor     rdx,rdx
        mov     rdx,[gs:rdx+96]    ;;PEB
        mov     rdx,[rdx+24]       ;;PEB->Ldr
        mov     rdx,[rdx+32]       ;;first module(InMemoryOrder module list)

_next:
        mov     rsi,[rdx+80]       ;;module name
        mov     cx,word [rdx+74]

        push    rdx

        ;; get pe header
        mov     rdx,[rdx+32]  ;;module base address
        mov     eax,dword [rdx+60] ;;pe header
        add     rax,rdx

        ;;get export table
        mov     eax,dword [rax+136] ;;export RVA     

I don't have x64 so I can't debug it, try to use OllyDbg and see where it fails -- btw are you sure hashes alone work on x64?

jnz _get_next_mod    

did my suggestion work or am I totally not understanding what you are trying to do? (because I don't )

did my suggestion work or am I totally not understanding what you are trying to do? (because I don't )

mov rax,[gs:30h]  ; RAX points to TEB (Thread Environment Block)
mov rcx,[rax+60h] ; RCX points to PEB (Process Environment Block)    

        push 60h
    pop rsi
     gs lodsq ; RAX points to PEB    

Code:

mov rax,[gs:30h]  ; RAX points to TEB (Thread Environment Block)
mov rcx,[rax+60h] ; RCX points to PEB (Process Environment Block)    

...and FDBG work for me.

FDBG source code has examples of accessing PEB.

(Your English is better than my Chinese - well done!)

How about a size optimized (6 bytes):

Code:

    push 60h
    pop rsi
     gs lodsq ; RAX points to PEB    

api_call:
  push rdx rcx rdi rsi rax 60h
        pop rsi
     gs lodsq
    mov rax,[rax+24]
    mov rdi,[rax+32]
.next_module:
       mov rsi,[rdi+80]
    movzx ecx,word [rdi+74]
     xor eax,eax
 cdq
 .module_name:
           lodsb
               and al,not 20h
              ror edx,13
          add edx,eax
         loop .module_name
   push rdi
    mov rdi,[rdi+32]
    mov eax,[rdi+60]
    lea rax,[rdi+rax+68]
        mov ecx,[rax+136-68]
        jrcxz .skip_module
  add rcx,rdi
 push rcx
    mov esi,[rcx+32]
    mov ecx,[rcx+24]
    add rsi,rdi
.next_function:
  jrcxz .get_module
   dec ecx
     push rdx rsi
                mov esi,[rsi+rcx*4]
         add rsi,rdi
         xor eax,eax
         .function_name:
                 lodsb
                       ror edx,13
                  add edx,eax
                 cmp al,ah
                   jne .function_name
          cmp edx,[rsp+8*4]
   pop rsi rdx
 jnz .next_function
  pop rsi
     mov edx,[rsi+36]
    add rdx,rdi
 mov cx,[rdx+2*rcx]
  mov eax,[rsi+28]
    add rax,rdi
 mov eax,[rax+4*rcx]
 add rax,rdi
 pop rdx rdx rsi rdi rcx rdx
 jmp rax

.get_module:
     pop rdx
.skip_module:
        pop rdi
     mov rdi,[rdi]
       jmp .next_module    

macro API_HASH32 dll,export {
   local ..b,..d
       ..d = 0
     virtual at $
                du `dll,0
           repeat $-$$
                 load ..b byte from $$+%-1
                   ..d = $FFFFFFFF and\
                               ((..d SHR 13)+(..d SHL 19)+\
                           (..b and (not 20h)))
            end repeat
  end virtual
 virtual at $
                db `export,0
                repeat $-$$
                 load ..b byte from $$+%-1
                   ..d = $FFFFFFFF and\
                               ((..d SHR 13)+(..d SHL 19)+\
                           ..b)
            end repeat
  end virtual
 mov eax,..d
}    

xor ecx,ecx
API_HASH32 ntdll.dll,RtlExitUserThread
call api_call    

I've optimized (141 bytes (almost as small as his 32-bit version ), and several other improvements) the api_call by Stephen Fewer for 64-bit and wrote a parallel FASM macro to calculate the hash values easily:

Code:

api_call:
      push rdx rcx rdi rsi rax 60h
        pop rsi
     gs lodsq
    mov rax,[rax+24]
    mov rdi,[rax+32]
.next_module:
       mov rsi,[rdi+80]
    movzx ecx,word [rdi+74]
     xor eax,eax
 cdq
 .module_name:
           lodsb
               and al,not 20h
              ror edx,13
          add edx,eax
         loop .module_name
   push rdi
    mov rdi,[rdi+32]
    mov eax,[rdi+60]
    lea rax,[rdi+rax+68]
        mov ecx,[rax+136-68]
        jrcxz .skip_module
  add rcx,rdi
 push rcx
    mov esi,[rcx+32]
    mov ecx,[rcx+24]
    add rsi,rdi
.next_function:
  jrcxz .get_module
   dec ecx
     push rdx rsi
                mov esi,[rsi+rcx*4]
         add rsi,rdi
         xor eax,eax
         .function_name:
                 lodsb
                       ror edx,13
                  add edx,eax
                 cmp al,ah
                   jne .function_name
          cmp edx,[rsp+8*4]
   pop rsi rdx
 jnz .next_function
  pop rsi
     mov edx,[rsi+36]
    add rdx,rdi
 mov cx,[rdx+2*rcx]
  mov eax,[rsi+28]
    add rax,rdi
 mov eax,[rax+4*rcx]
 add rax,rdi
 pop rdx rdx rsi rdi rcx rdx
 jmp rax

.get_module:
     pop rdx
.skip_module:
        pop rdi
     mov rdi,[rdi]
       jmp .next_module    

Code:

macro API_HASH32 dll,export {
   local ..b,..d
       ..d = 0
     virtual at $
                du `dll,0
           repeat $-$$
                 load ..b byte from $$+%-1
                   ..d = $FFFFFFFF and\
                               ((..d SHR 13)+(..d SHL 19)+\
                           (..b and (not 20h)))
            end repeat
  end virtual
 virtual at $
                db `export,0
                repeat $-$$
                 load ..b byte from $$+%-1
                   ..d = $FFFFFFFF and\
                               ((..d SHR 13)+(..d SHL 19)+\
                           ..b)
            end repeat
  end virtual
 mov eax,..d
}    

...the code can be used like:

Code:

xor ecx,ecx
API_HASH32 ntdll.dll,RtlExitUserThread
call api_call    

API_HASH32 <DLL>,<Function>

The DLL name is unicode and case insensitive;
while the Function is ASCII and case sensitive.

I can imagine a number of additional optimizations depending on use. For example, some adaptor code could be placed prior to JMP RAX - allowing various internal calling conventions to be used. Also, a hash table might help compact code. Note: I haven't checked for collisions nor is there an exit condition for hash not found.

Why do you wish to access APIs in this manner?

Sorry, I do not use instant messenger (MSN).
You can still be my friend.

i just use tasm or masm ever for virus.........just for interests! not damage!!

...

but i want study the virus technology in x64!!

so something maybe not suit talk aout here!!hoho:)

The DLL name is unicode and case insensitive;

bitRAKE wrote:

The DLL name is unicode and case insensitive;

No reason to have it unicode imho, since PE import tables only support ascii DLL names