flat assembler
Message board for the users of flat assembler.

Index > Windows > loadlibrary question

Author
Thread Post new topic Reply to topic
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 10 Mar 2010, 22:57
hay all.
my purpose is to do every thing that i can and want
without linking to any lib,
for example i want to create a program that display messagebox "hello fasm"

now my question is like this:
for the messagebox i need to inform windows that i need kernel32.dll to link

how this is done if the linker doesn't link my app to any lib ?

i thought about 2 posiibilities
1. i need to use loadlibrary api, to load and run the api i use
the problem with this option is, how the link to loadlibrary is done ?
remember - i don't want to use any lib, any startup code.

2. the linker put all the dll information in the exe header,
and on runtime windowsloader read the information from there
and make the linking.
this is the most preffered and logic option for me.

if this is the way or possible way to make the linking,
i wonder how i can do this in FASM (and also in C)
what's the declarations i need to make for this to work.
what the linker options etc...

thanks in advance.
Post 10 Mar 2010, 22:57
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 10 Mar 2010, 23:16
Is skipping the linker what are you looking for? If that is the case then just check the examples that come with fasm, all but the MSCOFF example don't need a linker to create the executable.

There is a trick to make import-less executables that consists in scanning the memory to locate KERNEL32.DLL and use GetProcAddress to find LoadLibrary and then use this two functions to load everything else. But note that this trick won't work in Windows 2000 because it can't run programs that don't end up importing KERNEL32.DLL before it starts to be executed and some AVs may probably find your program ultra-suspecting.
Post 10 Mar 2010, 23:16
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid 11 Mar 2010, 01:30
just a little hint: once you have located the DLL, you don't need to call GetProcAddress. You can rewrite all its functionality yourself.
Post 11 Mar 2010, 01:30
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 12 Mar 2010, 00:02
thanks for answering.

LocoDelAssembly wrote:
Is skipping the linker what are you looking for?"


no, i do want to use the linker, but i want it to put the dll linkage details, in the exe header ,
without linking to a lib file (which probably has startup code)
i want to do the startup code (that i don't know yet how to do it)
myself, instead of the library, and then the linker will insert all
the linking data in the exe header.

Quote:

check the examples that come with fasm, all but the MSCOFF example don't need a linker to create the executable.

this is sound very interesting, i will gladly check this out.

Quote:

There is a trick to make import-less executables that consists in scanning the memory to locate KERNEL32.DLL and use GetProcAddress to find LoadLibrary and then use this two functions to load everything else. But note that this trick won't work in Windows 2000 because it can't run programs that don't end up importing KERNEL32.DLL before it starts to be executed and some AVs may probably find your program ultra-suspecting.


no i don't want to use tricks like that at all.
as i said, i want to write simple startup code my self
without depending on any library,
and my first problem is
how to tell the linker to put the dll declerations (that my program use),
in the exe header (but without linking to a library).

second question: i want to know what the startup code
needed to start a program.
a link to sample code, or something like that, would be great.


Last edited by whatsup on 13 Mar 2010, 17:24; edited 1 time in total
Post 12 Mar 2010, 00:02
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 12 Mar 2010, 04:41
I expect only the libc library will have startup code. If you link to other libraries like kernel32.lib then they don't have startup code.

But you need to set your entry address in the linker command line and make it point to your own entry/startup code.
Post 12 Mar 2010, 04:41
View user's profile Send private message Visit poster's website Reply with quote
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 12 Mar 2010, 10:04
revolution wrote:
I expect only the libc library will have startup code. If you link to other libraries like kernel32.lib then they don't have startup code.


ok, but why do i need this lib,
my program use functions in kernel32.dll not kernel32.lib
so why is the lib file needed for ?


Quote:

But you need to set your entry address in the linker command line and make it point to your own entry/startup code.


yes, thank you.
Post 12 Mar 2010, 10:04
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 12 Mar 2010, 10:09
kernel32.lib provides the links in the import section for the kernel32.dll to be loaded, that is all. It is just part of the way the linkers and object files work.
Post 12 Mar 2010, 10:09
View user's profile Send private message Visit poster's website Reply with quote
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 13 Mar 2010, 17:26
revolution wrote:
kernel32.lib provides the links in the import section for the kernel32.dll to be loaded, that is all. It is just part of the way the linkers and object files work.


ok thank you very much,
i guess the lib is created along with the dll,
so i have to check this stuff by creating a dll, and learn more.
Post 13 Mar 2010, 17:26
View user's profile Send private message Reply with quote
Rob



Joined: 14 Mar 2010
Posts: 2
Rob 14 Mar 2010, 21:17
If you don't want to mess with .LIB files, you can use GoLink: it is quite easy to use as it directly links to the .DLLs.
Post 14 Mar 2010, 21:17
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid 14 Mar 2010, 21:43
Quote:
kernel32.lib provides the links in the import section for the kernel32.dll to be loaded, that is all. It is just part of the way the linkers and object files work.

Also, these .lib files provide "jump-to-address-in-IAT" instruction for every API they import. This allows you to call APIs (in fact, this jump instruction) with direct call, instead of indirect call.

But some compilers optimize this out, sometimes.
Post 14 Mar 2010, 21:43
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 20 Mar 2010, 16:49
thank you very much for kind help.

i will look in the link

i just thought of somthing, i need your confirmation

when a dll is created it is created with a lib to tell the linker how to build the
linkages

now in case my program uses a dll that i don't have its lib,
that's the point when the loadlibrary come ?
i mean , if i don't have the lib file of the dll i use,
i can use loadlibrary instead, to load the functions.
is that right ?
Post 20 Mar 2010, 16:49
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 26 Mar 2010, 02:19
Yes and no. LoadLibrary could actually be also used to load libraries that it is not certain that are always available, in case of fail you could resort to secondary code or report the error, while using the import table will trigger an OS error and your application won't get CPU control for even a single instruction.

Other uses are compression, the import table can't be compressed and still be suitable for the loader, so you could have some code to perform the manual binding to the API functions by uncompressing your custom data structure and then proceed to do LoadLibrary+GetProcAddress.

Probably there are more uses, what it is clear is that it was hardly designed to overcome the possibility of a missing .LIB.

Have I actually answered your question?
Post 26 Mar 2010, 02:19
View user's profile Send private message Reply with quote
whatsup



Joined: 01 Feb 2010
Posts: 8
whatsup 29 Mar 2010, 14:45
thank you very much.
yes i finally got this subject clear.
my problem was that i didn't know that dll need lib to build the exe file,
i always thought they must have some startup code.

also now i understand (i guess) how programs like vb for example work,
they don't use lib, so probably they use loadlibrary instead.
at least for sure, that's how BCX (basic translator) work.

thank you very much all for detailed explanation.

EDIT: now i looked in my first post
my first question was, how the link to loadlibrary is done ?
(if there is no lib)
Post 29 Mar 2010, 14:45
View user's profile Send private message Reply with quote
score_under



Joined: 27 Aug 2009
Posts: 27
score_under 06 Apr 2010, 00:44
whatsup wrote:

EDIT: now i looked in my first post
my first question was, how the link to loadlibrary is done ?
(if there is no lib)

If you look through the source to the MSCOFF example, you'll see this line:
Code:
extrn '__imp__MessageBoxA@16' as MessageBox:dword    

That name starts with '__imp__', telling the linker to import it, and ends with '@16' meaning it's stdcall and uses 16 bytes of stack space for its arguments (the same number used in the "retn" command at the end of the function). The part in the middle is rather easily identified as the function name.

Just alter the name and argument space ("MessageBoxA@16") and the label ("MessageBox"), and you should be able to use any function.

By the way, loadlibrary is "LoadLibraryA@4" and GetProcAddress is "GetProcAddress@8".
Post 06 Apr 2010, 00:44
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.