Index
> Windows > I need use inc from masm |
| Author |
|
|
n1kt0 20 Jul 2008, 20:05
I need use inc from masm
and I need to: mov to eax volue from MAGE_OPTIONAL_HEADER->SizeOfCode how I can do it? |
|||
20 Jul 2008, 20:05 |
|
|
n1kt0 21 Jul 2008, 06:51
heh, thank you, but I need used more include.have you binary file,which converted masm_inc 2 fasm ?
|
|||
|
21 Jul 2008, 06:51 |
|
|
comrade 21 Jul 2008, 15:31
Nah, I converted this one manually. I was going to send it to madmatt so he can include it in his Win32 package, but it is very incomplete. Iirc, these particular structures come from winnt.h, which contains a lot more stuff than this.
|
|||
|
21 Jul 2008, 15:31 |
|
|
n1kt0 29 Jul 2008, 07:14
is your imagehdr.inc is not full. I need full include, I'm fully work in the PE structure. I'm need REALE FULL include.
I'm thinking about automatic kits for the converted c inlude to the fasm include |
|||
|
29 Jul 2008, 07:14 |
|
|
madmatt 29 Jul 2008, 09:56
Hi n1kt0,
You can go to my website (click on the 'www' under my post), click on the esnips icon at the bottom of the webpage, download the file: 'fasmw16726.rar'. Look in the xinclude32/equates folder, what you are looking for will be in the kernel32.inc file. there are also other windows include/api files there too. |
|||
|
29 Jul 2008, 09:56 |
|
|
FrozenKnight 30 Jul 2008, 14:48
this is the one i created myself as you can see i have the MSDN structs side by side i used them for reference when creating the whole thing.
I think i have almost everything useful to the PE here. Code: ;#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ ;#define IMAGE_OS2_SIGNATURE 0x454E // NE ;#define IMAGE_OS2_SIGNATURE_LE 0x454C // LE ;#define IMAGE_VXD_SIGNATURE 0x454C // LE ;#define IMAGE_NT_SIGNATURE 0x00004550 // PE00 IMAGE_DOS_SIGNATURE = 0x5A4D IMAGE_OS2_SIGNATURE = 0x454E IMAGE_OS2_SIGNATURE_LE = 0x454C IMAGE_VXD_SIGNATURE = 0x454C IMAGE_NT_SIGNATURE = 0x00004550 ;typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header ; WORD e_magic; // Magic number ; WORD e_cblp; // Bytes on last page of file ; WORD e_cp; // Pages in file ; WORD e_crlc; // Relocations ; WORD e_cparhdr; // Size of header in paragraphs ; WORD e_minalloc; // Minimum extra paragraphs needed ; WORD e_maxalloc; // Maximum extra paragraphs needed ; WORD e_ss; // Initial (relative) SS value ; WORD e_sp; // Initial SP value ; WORD e_csum; // Checksum ; WORD e_ip; // Initial IP value ; WORD e_cs; // Initial (relative) CS value ; WORD e_lfarlc; // File address of relocation table ; WORD e_ovno; // Overlay number ; WORD e_res[4]; // Reserved words ; WORD e_oemid; // OEM identifier (for e_oeminfo) ; WORD e_oeminfo; // OEM information; e_oemid specific ; WORD e_res2[10]; // Reserved words ; LONG e_lfanew; // File address of new exe header ; } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; struct IMAGE_DOS_HEADER e_magic dw ? e_cblp dw ? e_cp dw ? e_crlc dw ? e_cparhdr dw ? e_minalloc dw ? e_maxalloc dw ? e_ss dw ? e_sp dw ? e_csum dw ? e_ip dw ? e_cs dw ? e_lfarlc dw ? e_ovno dw ? e_res dw 4 dup (?) e_oemid dw ? e_oeminfo dw ? e_res2 dw 10 dup (?) e_lfanew dd ? ends ;typedef struct _IMAGE_FILE_HEADER { ; WORD Machine; ; WORD NumberOfSections; ; DWORD TimeDateStamp; ; DWORD PointerToSymbolTable; ; DWORD NumberOfSymbols; ; WORD SizeOfOptionalHeader; ; WORD Characteristics; ;} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; struct IMAGE_FILE_HEADER Machine dw ? NumberOfSections dw ? TimeDateStamp dd ? PointerToSymbolTable dd ? NumberOfSymbols dd ? SizeOfOptionalHeader dw ? Characteristics dw ? ends ;#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 ;typedef struct _IMAGE_DATA_DIRECTORY { ; DWORD VirtualAddress; ; DWORD Size; ;} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; struct IMAGE_DATA_DIRECTORY VirtualAddress dd ? Size dd ? ends ;typedef struct _IMAGE_OPTIONAL_HEADER { ; // ; // Standard fields. ; // ; ; WORD Magic; ; BYTE MajorLinkerVersion; ; BYTE MinorLinkerVersion; ; DWORD SizeOfCode; ; DWORD SizeOfInitializedData; ; DWORD SizeOfUninitializedData; ; DWORD AddressOfEntryPoint; ; DWORD BaseOfCode; ; DWORD BaseOfData; ; ; // ; // NT additional fields. ; // ; ; DWORD ImageBase; ; DWORD SectionAlignment; ; DWORD FileAlignment; ; WORD MajorOperatingSystemVersion; ; WORD MinorOperatingSystemVersion; ; WORD MajorImageVersion; ; WORD MinorImageVersion; ; WORD MajorSubsystemVersion; ; WORD MinorSubsystemVersion; ; DWORD Win32VersionValue; ; DWORD SizeOfImage; ; DWORD SizeOfHeaders; ; DWORD CheckSum; ; WORD Subsystem; ; WORD DllCharacteristics; ; DWORD SizeOfStackReserve; ; DWORD SizeOfStackCommit; ; DWORD SizeOfHeapReserve; ; DWORD SizeOfHeapCommit; ; DWORD LoaderFlags; ; DWORD NumberOfRvaAndSizes; ; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; ;} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; struct IMAGE_OPTIONAL_HEADER32 ;Standard fields. Magic dw ? MajorLinkerVersion db ? MinorLinkerVersion db ? SizeOfCode dd ? SizeOfInitializedData dd ? SizeOfUninitializedData dd ? AddressOfEntryPoint dd ? BaseOfCode dd ? BaseOfData dd ? ;NT additional fields. ImageBase dd ? SectionAlignment dd ? FileAlignment dd ? MajorOperatingSystemVersion dw ? MinorOperatingSystemVersion dw ? MajorImageVersion dw ? MinorImageVersion dw ? MajorSubsystemVersion dw ? MinorSubsystemVersion dw ? Win32VersionValue dd ? SizeOfImage dd ? SizeOfHeaders dd ? CheckSum dd ? Subsystem dw ? DllCharacteristics dw ? SizeOfStackReserve dd ? SizeOfStackCommit dd ? SizeOfHeapReserve dd ? SizeOfHeapCommit dd ? LoaderFlags dd ? NumberOfRvaAndSizes dd ? DataDirectory IMAGE_DATA_DIRECTORY; IMAGE_NUMBEROF_DIRECTORY_ENTRIES dup (?) rb sizeof.IMAGE_DATA_DIRECTORY * (IMAGE_NUMBEROF_DIRECTORY_ENTRIES -1) ends ;typedef struct _IMAGE_NT_HEADERS { ; DWORD Signature; ; IMAGE_FILE_HEADER FileHeader; ; IMAGE_OPTIONAL_HEADER32 OptionalHeader; ;} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; struct IMAGE_NT_HEADERS32 Signature dd ? FileHeader IMAGE_FILE_HEADER OptionalHeader IMAGE_OPTIONAL_HEADER32 ends ;#define IMAGE_SIZEOF_SHORT_NAME 8 IMAGE_SIZEOF_SHORT_NAME = 8 ;typedef struct _IMAGE_SECTION_HEADER { ; BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; ; union { ; DWORD PhysicalAddress; ; DWORD VirtualSize; ; } Misc; ; DWORD VirtualAddress; ; DWORD SizeOfRawData; ; DWORD PointerToRawData; ; DWORD PointerToRelocations; ; DWORD PointerToLinenumbers; ; WORD NumberOfRelocations; ; WORD NumberOfLinenumbers; ; DWORD Characteristics; ;} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; struct IMAGE_SECTION_HEADER Name db IMAGE_SIZEOF_SHORT_NAME dup (?) union PhysicalAddress dd ? VirtualSize dd ? ends VirtualAddress dd ? SizeOfRawData dd ? PointerToRawData dd ? PointerToRelocations dd ? PointerToLinenumbers dd ? NumberOfRelocations dw ? NumberOfLinenumbers dw ? Characteristics dd ? ends ;typedef struct _IMAGE_IMPORT_DESCRIPTOR { ; union { ; DWORD Characteristics; // 0 for terminating null import descriptor ; DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) ; }; ; DWORD TimeDateStamp; // 0 if not bound, ; // -1 if bound, and real date\time stamp ; // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) ; // O.W. date/time stamp of DLL bound to (Old BIND) ; ; DWORD ForwarderChain; // -1 if no forwarders ; DWORD Name; ; DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) ;} IMAGE_IMPORT_DESCRIPTOR; ;typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR; struct IMAGE_IMPORT_DESCRIPTOR union Characteristics dd ? OriginalFirstThunk dd ? ends TimeDateStamp dd ? ForwarderChain dd ? Name dd ? FirstThunk dd ? ends ;typedef struct _IMAGE_IMPORT_BY_NAME { ; WORD Hint; ; BYTE Name[1]; ;} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME; struct IMAGE_IMPORT_BY_NAME Hint dw ? Name db 1 dup (?) ends ;typedef struct _IMAGE_THUNK_DATA32 { ; union { ; DWORD ForwarderString; // PBYTE ; DWORD Function; // PDWORD ; DWORD Ordinal; ; DWORD AddressOfData; // PIMAGE_IMPORT_BY_NAME ; } u1; ;} IMAGE_THUNK_DATA32; struct IMAGE_THUNK_DATA32 union ForwarderString dd ? Function dd ? Ordinal dd ? AddressOfData dd ? ends ends ;#define IMAGE_ORDINAL_FLAG32 0x80000000 IMAGE_ORDINAL_FLAG32 = 0x80000000 IMAGE_SCN_TYPE_REG = 0x00000000 ;Reserved. IMAGE_SCN_TYPE_DSECT = 0x00000001 ;Reserved. IMAGE_SCN_TYPE_NOLOAD = 0x00000002 ;Reserved. IMAGE_SCN_TYPE_GROUP = 0x00000004 ;Reserved. IMAGE_SCN_TYPE_NO_PAD = 0x00000008 ;Reserved. IMAGE_SCN_TYPE_COPY = 0x00000010 ;Reserved. IMAGE_SCN_CNT_CODE = 0x00000020 ;Section contains executable code. IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040 ;Section contains initialized data. IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080 ;Section contains uninitialized data. IMAGE_SCN_LNK_OTHER = 0x00000100 ;Reserved. IMAGE_SCN_LNK_INFO = 0x00000200 ;Reserved. IMAGE_SCN_TYPE_OVER = 0x00000400 ;Reserved. IMAGE_SCN_LNK_COMDAT = 0x00001000 ;Section contains COMDAT data. IMAGE_SCN_MEM_FARDATA = 0x00008000 ;Reserved. IMAGE_SCN_MEM_PURGEABLE = 0x00020000 ;Reserved. IMAGE_SCN_MEM_16BIT = 0x00020000 ;Reserved. IMAGE_SCN_MEM_LOCKED = 0x00040000 ;Reserved. IMAGE_SCN_MEM_PRELOAD = 0x00080000 ;Reserved. IMAGE_SCN_ALIGN_1BYTES = 0x00100000 ;Align data on a 1-byte boundary. IMAGE_SCN_ALIGN_2BYTES = 0x00200000 ;Align data on a 2-byte boundary. IMAGE_SCN_ALIGN_4BYTES = 0x00300000 ;Align data on a 4-byte boundary. IMAGE_SCN_ALIGN_8BYTES = 0x00400000 ;Align data on a 8-byte boundary. IMAGE_SCN_ALIGN_16BYTES = 0x00500000 ;Align data on a 16-byte boundary. IMAGE_SCN_ALIGN_32BYTES = 0x00600000 ;Align data on a 32-byte boundary. IMAGE_SCN_ALIGN_64BYTES = 0x00700000 ;Align data on a 64-byte boundary. IMAGE_SCN_ALIGN_128BYTES = 0x00800000 ;Align data on a 128-byte boundary. IMAGE_SCN_ALIGN_256BYTES = 0x00900000 ;Align data on a 256-byte boundary. IMAGE_SCN_ALIGN_512BYTES = 0x00A00000 ;Align data on a 512-byte boundary. IMAGE_SCN_ALIGN_1024BYTES = 0x00B00000 ;Align data on a 1024-byte boundary. IMAGE_SCN_ALIGN_2048BYTES = 0x00C00000 ;Align data on a 2048-byte boundary. IMAGE_SCN_ALIGN_4096BYTES = 0x00D00000 ;Align data on a 4096-byte boundary. IMAGE_SCN_ALIGN_8192BYTES = 0x00E00000 ;Align data on a 8192-byte boundary. IMAGE_SCN_LNK_NRELOC_OVFL = 0x01000000 ;Section contains extended relocations. IMAGE_SCN_MEM_DISCARDABLE = 0x02000000 ;Section can be discarded as needed. IMAGE_SCN_MEM_NOT_CACHED = 0x04000000 ;Section cannot be cached. IMAGE_SCN_MEM_NOT_PAGED = 0x08000000 ;Section cannot be paged. IMAGE_SCN_MEM_SHARED = 0x10000000 ;Section can be shared in memory. IMAGE_SCN_MEM_EXECUTE = 0x20000000 ;Section can be executed as code. IMAGE_SCN_MEM_READ = 0x40000000 ;Section can be read. IMAGE_SCN_MEM_WRITE = 0x80000000 ;Section can be written to. |
|||
|
30 Jul 2008, 14:48 |
|
< Last Thread | Next Thread > |
Forum Rules:
|