How to convert "mov fs:[0],esp" to FASM syntax?

Index > Main > How to convert "mov fs:[0],esp" to FASM syntax?

Goto page Previous 1, 2

Author

Thread

bitRAKE

Joined: 21 Jul 2003
Posts: 4039
Location: vpcmpistri

bitRAKE 07 Feb 2009, 06:49

Azu,

local {name}:{TYPE}

...the order is important.

07 Feb 2009, 06:49

sinsi

Joined: 10 Aug 2007
Posts: 789
Location: Adelaide

sinsi 07 Feb 2009, 06:54

wrong: "local DWORD:@dwReturn"
right: "local @dwReturn:DWORD"

edit:damn, the board is slow today...

07 Feb 2009, 06:54

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 07 Feb 2009, 06:59

OUCH thanks guys! I'm kind of slow today to, it seems.

One last bit of help would be great.. I'm not getting any more errors in that file, but I'm having problems calling it.

How it was originally used (invoke _GetKernelBase,[esp]) gives "operand size not specified error"

I thought I could fix this easily by specifying the operand size (invoke dword _GetKernelBase,dword[esp]) but that didn't work either, so I'm stumped again. Confused

I promise not to ask any more dumb question after this.. Razz

07 Feb 2009, 06:59

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20337
Location: In your JS exploiting you and your system

revolution 07 Feb 2009, 07:12

Remove the first "dword".

Code:

invoke _GetKernelBase,dword[esp]

07 Feb 2009, 07:12

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 07 Feb 2009, 07:16

I already tried it with just specifying the second one, with both, and with just the first Sad

invoke _GetKernelBase,dword[esp] gives "Error: operand size not specified.
Display:

Instruction:
call[_GetKernelBase]"

This compiles and runs fine

Code:

use32
format PE GUI 4.0
include 'J:\fasmw16727\INCLUDE\win32ax.inc'
include '_GetKernel.asm'
section '.text' code readable executable
start:
;                invoke _GetKernelBase,dword[esp]
push dword[esp]
call _GetKernelBase
ret
.end start

But I'd really prefer to use invoke to make it more readable and not take up as many lines.. I know I shouldn't be picky, but I just don't see why it should be having an error... Crying or Very sad

Last edited by Azu on 07 Feb 2009, 07:20; edited 1 time in total

07 Feb 2009, 07:16

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20337
Location: In your JS exploiting you and your system

revolution 07 Feb 2009, 07:18

Oh, is _GetKernelBase a local function of your own? In that case you should use stdcall/ccall instead of invoke.

Code:

stdcall Myfunc,dword[esp]

07 Feb 2009, 07:18

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 07 Feb 2009, 07:21

Thank you. I'm done making a fool out of myself for today. *sneaks away*

07 Feb 2009, 07:21

Goto page Previous 1, 2

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum