flat assembler
Message board for the users of flat assembler.

Index > Main > Problem with calls

Author
Thread Post new topic Reply to topic
Poppuff



Joined: 10 Jul 2012
Posts: 1
Poppuff
Hi i'm having an issue with the last version (dll)
When I write :

Code:
call 0097C790h    


it compiles it as

Code:
 call near ptr 97C790h    


How can I make it so that it compiles to what I write ? :/
Post 10 Jul 2012, 18:39
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
Get raw with it:

Code:
push retaddr
jmp 0097C790h
    
Post 10 Jul 2012, 20:41
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17350
Location: In your JS exploiting you and your system
revolution
Poppuff wrote:
Code:
call 0097C790h    


it compiles it as

Code:
 call near ptr 97C790h    


How can I make it so that it compiles to what I write ? :/
You have to use indirect addressing. The x86 CPU doesn't have absolute immediate calling.
Code:
call [thing]
;...
thing dd 0097C790h    
typedef: Using jmp won't help, it is still a relative jump.
Post 11 Jul 2012, 00:06
View user's profile Send private message Visit poster's website Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
revolution wrote:
Poppuff wrote:
Code:
call 0097C790h    


it compiles it as

Code:
 call near ptr 97C790h    


How can I make it so that it compiles to what I write ? :/
You have to use indirect addressing. The x86 CPU doesn't have absolute immediate calling.
Code:
call [thing]
;...
thing dd 0097C790h    
typedef: Using jmp won't help, it is still a relative jump.


How do you know it is? I thought of that but what if it's not in the "relative range"?
Post 11 Jul 2012, 00:45
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17350
Location: In your JS exploiting you and your system
revolution
typedef wrote:
How do you know it is? I thought of that but what if it's not in the "relative range"?
Relative range is +-2GB for 32-bit code, so the entire address space. If 64-bit code then you get an error when it is out of range.
Post 11 Jul 2012, 01:41
View user's profile Send private message Visit poster's website Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
revolution wrote:
typedef wrote:
How do you know it is? I thought of that but what if it's not in the "relative range"?
Relative range is +-2GB for 32-bit code, so the entire address space. If 64-bit code then you get an error when it is out of range.


lol. Just when I thought I graduated from this stuff. Damn you !
Post 11 Jul 2012, 02:44
View user's profile Send private message Reply with quote
r22



Joined: 27 Dec 2004
Posts: 805
r22
The RETurn instruction uses absolute addressing.
EIP <- POP()

Code:
PUSH @f
PUSH 0097C790h
RET
@@:
    
Post 11 Jul 2012, 13:19
View user's profile Send private message AIM Address Yahoo Messenger Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.