flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
vid
typedef:
1. There is no .sys driver. Driver file name can have any extension, and drivers with same extension (like .sys) can be of different format. Today, most drivers are PE executable, like normal windows executable file. 2. "NTSTATUS" is just a return type of function, the value you put into EAX upon return in Asm. Driver has one entry point, which is specified as any other PE entry point ("entry" directive described in manual). Inside the entry-point procedure, you set addresses to rest of functions your driver provides. 3. IIRC, there are some driver examples in examples section. |
|||
![]() |
|
typedef
So can you please show me how to do that in 32bit, coz the examples are all in 64.
|
|||
![]() |
|
Tyler
Code: format PE native entry main section '.text' executable readable main: nop Just a note: Norton AV freaked out when it found the file, and now I have to restart for it to remove it... AVs are a pain. |
|||
![]() |
|
typedef
@Tyler..thank you so much dude.
I wont have a problem with AV's I have sophisticated tools to break the Self Protection Module of AV's while they are running. ![]() ![]() |
|||
![]() |
|
LocoDelAssembly
Tyler, that code actually produces a native executable, not a native driver.
Take a look at this: http://board.flatassembler.net/topic.php?p=29031#29031 |
|||
![]() |
|
Tyler
LocoDelAssembly wrote: Tyler, that code actually produces a native executable, not a native driver. I was just going by the manual: 2.4.2 Portable Executable wrote: 2.4.2 Portable Executable P.S. When assembling the code above, Fasm will, by default, suffix ".sys". |
|||
![]() |
|
LocoDelAssembly
I'm really surprised, I was sure that forgetting to use "DLL" made a native executable.
[edit]Oh, here is where I've got the confusion from. fasm always produces .sys, those examples come with batch files that rename to .exe. |
|||
![]() |
|
LocoDelAssembly
Maybe I'm wrong but by playing a bit with a hex editor I see that FASM brands the .SYS with IMAGE_DLLCHARACTERISTICS_WDM_DRIVER when "native DLL" is used. I think it is better not to omit DLL then.
|
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.