flat assembler
Message board for the users of flat assembler.

Index > Windows > Write Resource to File

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Is it possible to read resource data and write it to a file at runtime? I'm sort of new to assembly so if it is possible, could someone explain how? I've tried searching the forum but didnt find anything specific, but I do apologize if I posted about something that's already been answered. Thanks in advance! Very Happy

_________________
Sit vis vobiscum!
Post 29 Jul 2011, 00:12
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
Post 29 Jul 2011, 00:54
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Thanks! I'll post back if I have any further questions!
Post 29 Jul 2011, 01:08
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
Post 29 Jul 2011, 11:15
View user's profile Send private message Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1413
Location: Toronto, Canada
AsmGuru62
I doubt that you can write to your own EXE file.
Post 29 Jul 2011, 12:57
View user's profile Send private message Send e-mail Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Overflowz:
Yeah I figured that out from MSDN. Thanks though!

Everyone and Anyone:
I have a question. In another portion of my code I'm using resources to draw an image (or I will be as soon as I can get my image to load Confused ), I'm using OllyDebug and finding that GetLastError is returning ERROR_INVALID_HANDLE at my breakpoint in the following code:
Code:
section '.data' data readable writeable
        HMOD         dd ?
        SysW          dd ?
        SysH           dd ?
        IMAGE         db 'IMAGE',0
        BITMAP       dd ?
        ...
section '.code' code readable executable
        push 0
        call [GetModuleHandle]
        mov [HMOD],eax

        push 0
        call [GetSystemMetrics]
        mov [SysW],eax
        push 1
        call [GetSystemMetrics];user32.dll
        mov [SysH],eax
        push 0x00000000
        push [SysH]
        push [SysW]
        push 0
        push IMAGE
        push [HMOD]
        call [LoadImage];user32.dll
        mov [Bitmap],eax
        int 3                    ;Breakpoint
        ...
    

I'm not sure exactly what I'm doing wrong here.
Post 29 Jul 2011, 13:08
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Oh and I dont want to write to my own EXE. I want to write that resource to a wav file, but that's later on in my code.
Post 29 Jul 2011, 13:09
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17492
Location: In your JS exploiting you and your system
revolution
GoodbyeWorld wrote:
I'm not sure exactly what I'm doing wrong here.
Without an full compilable example showing the problem we also don't know what you are doing wrong.
Post 29 Jul 2011, 13:13
View user's profile Send private message Visit poster's website Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
GoodbyeWorld
Maybe this ?
BITMAP dd ?
mov [Bitmap],eax
BITMAP != Bitmap
EDIT:
as I guess, BITMAP is structure..
Post 29 Jul 2011, 13:40
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Oh. Yeah. Sorry. I changed it and I'm still getting the error at runtime.
And here's an example:
Code:
format PE GUI 4.0
INCLUDE 'C:\ASM\FASM\INCLUDE\WIN32A.INC'
ENTRY START
SECTION '.data' DATA READABLE WRITEABLE
        IMAGE        db 'IMAGE',0
        WAVE       db 'WAVE',0
        HMOD         dd ?
        SysW         dd ?
        SysH         dd ?
        RHand        dd ?
        Bitmap       dd ?
        PointRes     dd ?
        SizeRes      dd ?
        FHAND        dd ?
        FNAME        db 'C:\WAVE.wav',0
SECTION '.code' CODE READABLE EXECUTABLE
START:
        push 0
        call [GetHandle]
        mov [HMOD],eax

        push 0
        call [GetSysMet]
        mov [SysW],eax
        push 1
        call [GetSysMet]
        mov [SysH],eax
        push 0x00000000
        push [SysH]
        push [SysW]
        push 0
        push IMAGE
        push [HMOD]
        call [LoadImg]
        mov [Bitmap],eax
        int 3
        push [HMOD]
        push WAVE
        push RT_RCDATA
        call [FindRes]
        mov [RHand],eax

        push [HMOD]
        push [RHand]
        call [LoadRes]
        push eax


        call [LockRes]
        mov [PointRes],eax

        push [HMOD]
        push [RHand]
        call [SzRes]
        mov [SizeRes],eax

        push 0
        push 1 xor 2
        push 2
        push 0
        push 0
        push GENERIC_ALL
        push FNAME
        call [CreateFile]
        mov [FHAND],eax


        push 0
        push 0
        push [SizeRes]
        push [PointRes]
        push [FHAND]
        call [WriteFile]


        push [FHAND]
        call [CloseHandle]

Cleanup:
        push [Bitmap]
        call [DeleteObj]
        push 0
        call[ExitProcess]
SECTION '.idata' IMPORT DATA READABLE EXECUTABLE
        library gdi32,'GDI32.DLL',\
                gdiplus,'GDIPLUS.DLL',\
                kernel32,'KERNEL32.DLL',\
                shell32,'SHELL32.DLL',\
                user32,'USER32.DLL',\
                winmm,'WINMM.DLL'
        import shell32,\
               Execute,'ShellExecuteA'
        import kernel32,\
               FormatMessage,'FormatMessageA',\
               GetLastError,'GetLastError',\
               ExitProcess,'ExitProcess',\
               GetRsc,'FindResourceA',\
               GetHandle,'GetModuleHandleA',\
               FindRes,'FindResourceA',\
               LoadRes,'LoadResource',\
               LockRes,'LockResource',\
               SzRes,'SizeofResource',\
               WriteFile,'WriteFile',\
               CreateFile,'CreateFileA',\
               CloseHandle,'CloseHandle'
        import gdi32,\
               GetDC,'GetDC',\
               DeleteObj,'DeleteObject'
        import user32,\
               LoadImg,'LoadImageA',\
               GetSysMet,'GetSystemMetrics',\
               MessageBox,'MessageBoxA'
        import winmm,\
               mciSS,'mciSendStringA'
SECTION '.rsrc' DATA READABLE RESOURCE FROM 'MyRes.res'
    

If you need to see the MyRes.res File, let me know.
Post 29 Jul 2011, 13:58
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
Found some mistakes. When you're calling "FindResource" API, you are using bad argument at ResourceType. Here:
Code:
0040204F   |.  FF35 0B104000    PUSH DWORD PTR DS:[40100B]                                                         ; /ResourceType = "MZ\x80"
00402055   |.  68 06104000      PUSH format.00401006                                                               ; |ResourceName = "WAVE"
0040205A   |.  6A 0A            PUSH 0A                                                                            ; |hModule = 0000000A
0040205C   |.  FF15 A4304000    CALL DWORD PTR DS:[<&KERNEL32.FindResourceA>]                                      ; \FindResourceA    

instead of buffer, you should use which type of resource it is. For example, place it in RC_RCDATA type and then use:
Code:
push hMod
push <"WAVE">
push RT_RCDATA
call [FindResource]    

You called it reversely Very Happy here:
Code:
        push [HMOD] 
        push WAVE 
        push RT_RCDATA 
        call [FindRes]    

use invoke instead of PUSH&CALL-s.
Code:
push RT_RCDATA
push WAVE
push [HMOD]
call [FindRes]    
equal to
Code:
invoke FindResource,[HMOD],WAVE,RC_RCDATA    


Last edited by Overflowz on 29 Jul 2011, 15:30; edited 5 times in total
Post 29 Jul 2011, 14:08
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Wait, you'll need that to compile it, so I'll just go ahead and post it.
Image
I would post the file, but the filename *.res is not allowed.


Description: XN Resource Editor - MyRes.res
(in case you cant see the image)
Filesize: 20.99 KB
Viewed: 3014 Time(s)

MyRes.PNG



_________________
Sit vis vobiscum!
Post 29 Jul 2011, 14:10
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
If you absolutely have to download the file, http://frazierb.com/MyRes.res
Post 29 Jul 2011, 14:15
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Thanks, Overflowz!
Post 29 Jul 2011, 14:26
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
P.S, are you using debugger to see results ? It would help you a lot.
Post 29 Jul 2011, 14:28
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
Yes, I am using OllyDbg. It's still showing me this when I debug it and get to the breakpoint.


Description: OllyDbg output
Filesize: 15.38 KB
Viewed: 2996 Time(s)

OllyDbg.PNG


Post 29 Jul 2011, 14:32
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
GoodbyeWorld
Instead LoadImage, use LoadBitmap Smile
Code:
push IMAGE
push [HMOD]
call [LoadBitmap]    

Works fine for me Wink


Last edited by Overflowz on 29 Jul 2011, 14:49; edited 2 times in total
Post 29 Jul 2011, 14:47
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
It says it's been superseded by LoadImage, but I'll try it.
Post 29 Jul 2011, 14:48
View user's profile Send private message Reply with quote
GoodbyeWorld



Joined: 21 Jul 2011
Posts: 12
GoodbyeWorld
It worked! Thanks!
Post 29 Jul 2011, 14:51
View user's profile Send private message Reply with quote
Overflowz



Joined: 03 Sep 2010
Posts: 1046
Overflowz
Here you go, your full working code.
Code:
format PE GUI 4.0
include 'WIN32AX.INC'
ENTRY START
SECTION '.data' DATA READABLE WRITEABLE 
        IMAGE        db 'IMAGE',0 
        WAVE       db 'WAVE',0 
        HMOD         dd ? 
        SysW         dd ? 
        SysH         dd ? 
        RHand        dd ? 
        Bitmap       dd ? 
        PointRes     dd ? 
        SizeRes      dd ? 
        FHAND        dd ?
        wbytes       dd ?
        FNAME        db 'C:\WAVE.wav',0 
SECTION '.code' CODE READABLE EXECUTABLE 
START: 
        push 0 
        call [GetHandle] 
        mov [HMOD],eax 
        push 0
        call [GetSysMet] 
        mov [SysW],eax 
        push 1 
        call [GetSysMet] 
        mov [SysH],eax
        invoke LoadBitmap,[HMOD],IMAGE
        mov [Bitmap],eax 
        push RT_RCDATA
        push WAVE 
        push [HMOD]
        call [FindRes] 
        mov [RHand],eax 

        push [RHand]
        push [HMOD]
        call [LoadRes] 
        push eax 


        call [LockRes] 
        mov [PointRes],eax 

        push [RHand]
        push [HMOD]
        call [SzRes] 
        mov [SizeRes],eax 

        push 0 
        push 1 xor 2 
        push 2 
        push 0 
        push 0 
        push GENERIC_ALL 
        push FNAME 
        call [CreateFile] 
        mov [FHAND],eax 


        push 0 
        push wbytes
        push [SizeRes] 
        push [PointRes] 
        push [FHAND] 
        call [WriteFile] 


        push [FHAND] 
        call [CloseHandle] 

Cleanup: 
        push [Bitmap] 
        call [DeleteObj] 
        push 0 
        call[ExitProcess] 
SECTION '.idata' IMPORT DATA READABLE EXECUTABLE 
        library gdi32,'GDI32.DLL',\ 
                gdiplus,'GDIPLUS.DLL',\ 
                kernel32,'KERNEL32.DLL',\ 
                shell32,'SHELL32.DLL',\ 
                user32,'USER32.DLL',\ 
                winmm,'WINMM.DLL' 
        import shell32,\ 
               Execute,'ShellExecuteA' 
        import kernel32,\ 
               FormatMessage,'FormatMessageA',\ 
               GetLastError,'GetLastError',\ 
               ExitProcess,'ExitProcess',\ 
               GetRsc,'FindResourceA',\ 
               GetHandle,'GetModuleHandleA',\ 
               FindRes,'FindResourceA',\ 
               LoadRes,'LoadResource',\ 
               LockRes,'LockResource',\ 
               SzRes,'SizeofResource',\ 
               WriteFile,'WriteFile',\ 
               CreateFile,'CreateFileA',\ 
               CloseHandle,'CloseHandle' 
        import gdi32,\ 
               GetDC,'GetDC',\ 
               DeleteObj,'DeleteObject' 
        import user32,\ 
               LoadImg,'LoadImageA',\ 
               GetSysMet,'GetSystemMetrics',\ 
               MessageBox,'MessageBoxA',\
               LoadBitmap,'LoadBitmapA'
        import winmm,\ 
               mciSS,'mciSendStringA'
section '.rsrc' data readable resource from 'MyRes.res'    

added wbytes for WriteFile and some API calls was called incorrectly. Fixed everything. Next time, try to fix them yourself Smile
P.S I guess you're trying to make some "PRANK VIRUS" ))
Post 29 Jul 2011, 14:59
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.