flat assembler
Message board for the users of flat assembler.

Index > Windows > producing .sys drivers using fasm

Author
Thread Post new topic Reply to topic
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
hie.
can someone show me an example of how to produce .sys drivers using fasm. i read the fasm.pdf but i dont know how to set the entry points for the files. for example in Cpp its NTSTATUS, so would that be just any regular entry point in fasm?
it would be helpful to have an example also. thank you
Post 15 Aug 2010, 06:08
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
typedef:

1. There is no .sys driver. Driver file name can have any extension, and drivers with same extension (like .sys) can be of different format. Today, most drivers are PE executable, like normal windows executable file.

2. "NTSTATUS" is just a return type of function, the value you put into EAX upon return in Asm. Driver has one entry point, which is specified as any other PE entry point ("entry" directive described in manual). Inside the entry-point procedure, you set addresses to rest of functions your driver provides.

3. IIRC, there are some driver examples in examples section.
Post 15 Aug 2010, 07:49
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
So can you please show me how to do that in 32bit, coz the examples are all in 64.
Post 16 Aug 2010, 02:57
View user's profile Send private message Reply with quote
Tyler



Joined: 19 Nov 2009
Posts: 1216
Location: NC, USA
Tyler
Code:
format PE native
entry main

section '.text' executable readable
main:
    nop
    

Just a note: Norton AV freaked out when it found the file, and now I have to restart for it to remove it... AVs are a pain.
Post 16 Aug 2010, 03:19
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
@Tyler..thank you so much dude.

I wont have a problem with AV's
I have sophisticated tools to break the Self Protection Module of AV's while they are running. Smile Very Happy
Post 16 Aug 2010, 04:00
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
Tyler, that code actually produces a native executable, not a native driver.

Take a look at this: http://board.flatassembler.net/topic.php?p=29031#29031
Post 16 Aug 2010, 04:20
View user's profile Send private message Reply with quote
Tyler



Joined: 19 Nov 2009
Posts: 1216
Location: NC, USA
Tyler
LocoDelAssembly wrote:
Tyler, that code actually produces a native executable, not a native driver.

Take a look at this: http://board.flatassembler.net/topic.php?p=29031#29031

I was just going by the manual:
2.4.2 Portable Executable



To select the Portable Executable output format, use format PE directive, it
can be followed by additional format settings: first the target subsystem
setting, which can be console or GUI for Windows applications, native
for Windows drivers
, EFI, EFIboot or EFIruntime for the UEFI. DLL
keyword following the subsystem setting marks the output file as a dynamic link
library. Then can follow the at operator and the numerical expression
specifying the base of PE image and then optionally on operator followed by
the quoted string containing file name selects custom MZ stub for PE program
(when specified file is not a MZ executable, it is treated as a flat binary
executable file and converted into MZ format). The default code setting for
this format is 32-bit. The example of fully featured PE format declaration:

format PE GUI 4.0 DLL at 7000000h on 'stub.exe'



To create PE file for the x86-64 architecture, use PE64 keyword instead of
PE in the format declaration, in such case the long mode code is generated
by default.


section directive defines a new section, it should be followed by quoted
string defining the name of section, then one or more section flags can
follow. Available flags are: code, data, readable, writeable,
executable, shareable, discardable, notpageable.
The origin of section is aligned to page (4096 bytes). Example declaration of PE section:

section '.text' code readable executable



Among with flags also one of the special PE data identifiers can be specified to mark the whole
section as a special data, possible identifiers are export, import,
resource and fixups. If the section is marked to contain fixups, they are
generated automatically and no more data needs to be defined in this section.
Also resource data can be generated automatically from the resource file, it
can be achieved by writing the from operator and quoted file name after the
resource identifier. Below are the examples of sections containing some special PE data:

section '.reloc' data discardable fixups
section '.rsrc' data readable resource from 'my.res'



entry directive sets the entry point for Portable Executable, the value of
entry point should follow.


stack directive sets up the size of stack for Portable Executable, value
of stack reserve size should follow, optionally value of stack commit
separated with comma can follow. When stack is not defined, it's set by
default to size of 4096 bytes.


heap directive chooses the size of heap for Portable Executable, value of
heap reserve size should follow, optionally value of heap commit separated
with comma can follow. When no heap is defined, it is set by default to size
of 65536 bytes, when size of heap commit is unspecified, it is by default set
to zero.


data directive begins the definition of special PE data, it should be
followed by one of the data identifiers (export, import, resource or
fixups) or by the number of data entry in PE header. The data should be
defined in next lines, ended with end data directive. When fixups data
definition is chosen, they are generated automatically and no more data needs
to be defined there. The same applies to the resource data when the resource
identifier is followed by from operator and quoted file name - in such case
data is taken from the given resource file.


The rva operator can be used inside the numerical expressions to obtain
the RVA of the item addressed by the value it is applied to.

P.S. When assembling the code above, Fasm will, by default, suffix ".sys".
Post 16 Aug 2010, 04:59
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
I'm really surprised, I was sure that forgetting to use "DLL" made a native executable.

[edit]Oh, here is where I've got the confusion from. fasm always produces .sys, those examples come with batch files that rename to .exe.
Post 16 Aug 2010, 05:22
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
Maybe I'm wrong but by playing a bit with a hex editor I see that FASM brands the .SYS with IMAGE_DLLCHARACTERISTICS_WDM_DRIVER when "native DLL" is used. I think it is better not to omit DLL then.
Post 16 Aug 2010, 05:49
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.