flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
vid 15 Aug 2010, 07:49
typedef:
1. There is no .sys driver. Driver file name can have any extension, and drivers with same extension (like .sys) can be of different format. Today, most drivers are PE executable, like normal windows executable file. 2. "NTSTATUS" is just a return type of function, the value you put into EAX upon return in Asm. Driver has one entry point, which is specified as any other PE entry point ("entry" directive described in manual). Inside the entry-point procedure, you set addresses to rest of functions your driver provides. 3. IIRC, there are some driver examples in examples section. |
|||
![]() |
|
typedef 16 Aug 2010, 02:57
So can you please show me how to do that in 32bit, coz the examples are all in 64.
|
|||
![]() |
|
Tyler 16 Aug 2010, 03:19
Code: format PE native entry main section '.text' executable readable main: nop Just a note: Norton AV freaked out when it found the file, and now I have to restart for it to remove it... AVs are a pain. |
|||
![]() |
|
typedef 16 Aug 2010, 04:00
@Tyler..thank you so much dude.
I wont have a problem with AV's I have sophisticated tools to break the Self Protection Module of AV's while they are running. ![]() ![]() |
|||
![]() |
|
LocoDelAssembly 16 Aug 2010, 04:20
Tyler, that code actually produces a native executable, not a native driver.
Take a look at this: http://board.flatassembler.net/topic.php?p=29031#29031 |
|||
![]() |
|
Tyler 16 Aug 2010, 04:59
LocoDelAssembly wrote: Tyler, that code actually produces a native executable, not a native driver. I was just going by the manual: 2.4.2 Portable Executable wrote: 2.4.2 Portable Executable P.S. When assembling the code above, Fasm will, by default, suffix ".sys". |
|||
![]() |
|
LocoDelAssembly 16 Aug 2010, 05:22
I'm really surprised, I was sure that forgetting to use "DLL" made a native executable.
[edit]Oh, here is where I've got the confusion from. fasm always produces .sys, those examples come with batch files that rename to .exe. |
|||
![]() |
|
LocoDelAssembly 16 Aug 2010, 05:49
Maybe I'm wrong but by playing a bit with a hex editor I see that FASM brands the .SYS with IMAGE_DLLCHARACTERISTICS_WDM_DRIVER when "native DLL" is used. I think it is better not to omit DLL then.
|
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.