flat assembler
Message board for the users of flat assembler.
![]() Goto page 1, 2 Next |
Author |
|
Nameless
i found this code, im trying to study it. but the thing is it works on xp sp2 only ! no vista or 7, i cant see y?? any help?
|
|||||||||||
![]() |
|
revolution
Your code relies on undocumented behaviour. So you should expect it to break whenever MS release a new patch or version.
|
|||
![]() |
|
Alphonso
Does this help. http://board.flatassembler.net/topic.php?p=103427#103427
|
|||
![]() |
|
f0dder
Where does it fail? I assume you have traced the code with a debugger? (OK, actually no, I don't - I expect that you expect us to do it for you
![]() |
|||
![]() |
|
bitRAKE
Nameless wrote: still reading about coding, next stage is debugging, then hex-editors, then taking over the world, wanna join? ill offer you total health insurance and a chair next to the window in my castle??? |
|||
![]() |
|
ziral2088
Code: ;Get base of ntdll into register. macro GetBaseOfNtdllInto.x64 reg { mov reg , [gs:dword 30h] ;TEB mov reg , [reg + 60h] ;PEB mov reg , [reg + 24] ;PEB->Ldr mov reg , [reg + 32] ;first module(InMemoryOrder module list) mov reg , [reg] ;assume that ntdll will be second in module list. mov reg , [reg + 32] ;LDR_MODULE64.BaseAddress } macro GetBaseOfNtdllInto.x86 reg { mov reg , [fs:dword 18h] ;TEB mov reg , [reg + 30h] ;PEB mov reg , [reg + 0Ch] ;PEB->Ldr mov reg , [reg + 20] ;first module(InMemoryOrder module list) mov reg , [reg] ;assume that ntdll will be second in module list. mov reg , [reg + 16] ;LDR_MODULE.BaseAddress } After that u need to use LdrGetDllHandle\LdrLoadDll to get base of kernel32.dll. Thats the only document method i know. Works fine on XP-Win7 x86-x64. |
|||
![]() |
|
revolution
Windows has the fully documented LoadLibrary and GetProcAddress functions. Works on ALL versions of Windows. Problem solved.
No need for all this undocumented, pray it works, hope MS don't change anything, stuff ![]() |
|||
![]() |
|
Nameless
where is the fun in LoadLibrary and GetProcAddress???
normal APIs that can be used in any high level language, so y bother and go low level asm if im gonna do the same thing ???!!!!!!!! |
|||
![]() |
|
f0dder
Nameless wrote: where is the fun in LoadLibrary and GetProcAddress??? It's fun poking around in the system for sure, just don't rely on undocumented stuff in released software. _________________ ![]() |
|||
![]() |
|
ziral2088
LdrLoadDll and LdrGetDllHandle are not an undocumented stuff. Microsoft uses them.
If u want to write native application u will use only native API. |
|||
![]() |
|
f0dder
ziral2088 wrote: LdrLoadDll and LdrGetDllHandle are not an undocumented stuff. Microsoft uses them. Besides, I was referring to the "reading from magic memory locations" part of your code. _________________ ![]() |
|||
![]() |
|
Nameless
@f0dder: im just having fun, im not coding anything for real yet, trying to learn as much as possible first
@ziral2088: i like that example, im going nerd-shit on it right now to understand it ![]() can u just tell me what this line mean? Code: mov reg , [gs:dword 30h] ; or even mov reg , [fs:dword 18h] ; any of them will be fine, just to know whats going on here i dunno what gs is, neither what operation is this supposed to be no super duper n00b style commenting ??? ![]() |
|||
![]() |
|
revolution
Nameless: fs is the fifth segment register, and gs the sixth. The AMD or Intel manuals will show you this. In some versions of Windows the fs segment is set to point to some process specific buffers. And the reason you have no idea what is happening is because these are not officially documented anywhere.
|
|||
![]() |
|
baldr
revolution,
Exactly those are well-documented, they're .Self fields of NT_TIB32/NT_TIB64. Yes, I'm nit-picking — I'm against this undocumented stuff too (it's useful in hacking, not in production codebase). And there was an error already: NT_TIB64.Self is 64-bit, as one may expect. |
|||
![]() |
|
f0dder
baldr: take heed of the word officially in revolution's post
![]() (I know you know this, so the comment is really directed at other people who're following the thread, not you ![]() |
|||
![]() |
|
Nameless
revolution, i searched the 5 manuals for this and i couldn't find it, can u tell me which one exactly should i look in or a keyword i should look for? none says what gs holds (maybe i was searching wrong) ty, |
|||
![]() |
|
baldr
f0dder,
Does WinNT.H from MS VS 2008 qualify as "officially documented"? Windows Research Kernel probably don't. ![]() ----8<---- Nameless, Intel manuals won't tell you this, it's Microsoft-specific. x86-64 Windows uses gs to hold selector for segment containing TEB for current thread (in user-mode; for kernel-mode it contains KPCR). |
|||
![]() |
|
Nameless
ok, and how did u find that out? what document do i need to know this things?
|
|||
![]() |
|
baldr
Nameless,
Can't remember that. Probably some weird mix of Google, IDA disassembly of various Windows x86-64 .DLLs and "* Internals" books. Are you really need to know this kind of things right now? |
|||
![]() |
|
Goto page 1, 2 Next < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.