flat assembler
Message board for the users of flat assembler.

Index > Windows > How to compile simple windows driver in FASM ?

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
im ok with FASM syntax
but how to compile driver in fasm ?
Code:
#include <ntddk.h>

void Unload(PDRIVER_OBJECT pDriverObject)
{
    DbgPrint("Unload routine called.\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
    pDriverObject->DriverUnload=Unload;

    DbgPrint("Hello world from driver.\n");
    return STATUS_SUCCESS;
}
    

_________________
Image
Post 09 Jun 2013, 11:56
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
Have a look at the FAQ and look for the driver section.

There are also a few other topics on here that have driver code. You can use Google to search this board with the "site:board.flatassembler.net" parameter.
Post 09 Jun 2013, 12:09
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
ok thanks but where can i find .inc with definitions of constants ?

_________________
Image
Post 09 Jun 2013, 12:16
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
The MSDN site has the constants. I'm not sure if someone has made a fasm .inc file or not, but the C includes are relatively straight forward to convert.
Post 09 Jun 2013, 12:21
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
well this code gives me error:
Code:
format PE native

section '.flat' code executable  readable writable notpageable

jmp _main

hello1: db 'Hello World !',0
;on_exit: db 'Driver Terminated',0

_main:

push hello1
call DbgPrint

section '.idata' import data readable writeable

         library ntdll,'ntdll.dll' ;  illegal instruction


         import ntdll\
                  DbgPrint,'DbgPrint'          

_________________
Image
Post 09 Jun 2013, 13:25
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
Try with:
Code:
call [DbgPrint]    
And remember to return from the procedure or it will crash after doing the print.
Post 09 Jun 2013, 13:27
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
just did as you said but get same error at line 17: illegal instruction
library ntdll,'ntdll.dll'

thanks in advance

_________________
Image
Post 09 Jun 2013, 13:30
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
You will need to include the macro package if you haven't already done that:
Code:
include 'win32ax.inc'    
Place it after the format ... line. And also you need to end the file with:
Code:
.end    
.

Have a look in the examples folder in the fasm download to see how to make a basic PE file.
Post 09 Jun 2013, 13:35
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
thanks it fixed error with import but another error appeared
my current code:
Code:
format PE native
include 'win32ax.inc'

section '.flat' code executable  readable writable notpageable
jmp _main
hello1: db 'Hello World !',0
;on_exit: db 'Driver Terminated',0
_main:
push hello1
call [DbgPrint]
ret 1

section '.idata' import data readable writeable

         library ntdll,'ntdll.dll'
 ; !!! error : extra characters on line :
         import ntdll\                     
                  DbgPrint,'DbgPrint'   
.end                            


by the way how to receive parameters like in C equivalent ?
Code:
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)    
Post 09 Jun 2013, 13:41
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
Have a look at the proc macro. With that you can define the incoming parameters (see the DLL example code).

You also need to define your entry point. This is done with the .end macro (see the PE example code).

BTW: "ret 1" is not going to work. More likely something like "ret 8" if there are two incoming parameters. But the proc macro can take care of the for you if you want use it.
Post 09 Jun 2013, 13:48
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
I just realised you don't have a reloc section. And you also need to designate a driver as a DLL.

edit: I searched and found this topic:
http://board.flatassembler.net/topic.php?t=14286
Post 09 Jun 2013, 13:58
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
this is my final code. when i try run it with OSR Driver Loader i get error
"The specified procedure could not be fount"
Code:
format PE native
include 'win32ax.inc'
entry DriverEntry

section '.flat' code executable  readable writable notpageable

hello1: db 'Hello World !',0



proc DriverEntry
        push hello1
        call [DbgPrint]
        ret
endp


section '.idata' import data readable writeable

         library ntdll,'ntdll.dll'


         import ntdll,\
                  DbgPrint,'DbgPrint'


section '.reloc' fixups data readable discardable
                                                                           
Post 09 Jun 2013, 14:18
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
Where is your .end line?

And the DLL declaration?
Post 09 Jun 2013, 14:20
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
what do you mean in dll declaration ?
.end were causing error

btw can you give me link to example please ?
Post 09 Jun 2013, 14:28
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17253
Location: In your JS exploiting you and your system
revolution
Post 09 Jun 2013, 14:32
View user's profile Send private message Visit poster's website Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
thanks but i have no such include "\DDK\INCLUDE\DDK\ntstatus.inc" in fasm directory where to get it ?
Post 09 Jun 2013, 14:44
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
xDOBORAx wrote:
thanks but i have no such include "\DDK\INCLUDE\DDK\ntstatus.inc" in fasm directory where to get it ?
That's because you're not a proper driver developer, I think. Wink
Post 09 Jun 2013, 16:08
View user's profile Send private message Reply with quote
xDOBORAx



Joined: 09 Jun 2013
Posts: 24
xDOBORAx
of course im not thats why im asking questions.
where should i get proper incs ? Sad
Post 09 Jun 2013, 17:41
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
lol. Looking at what's making you "fall" right now makes me doubt that once you see the meat of the actual driver you will proceed.

I'm not trying to beat you down but you will fail. You don't even know the structure of the file, how it's loaded, privileges and all that.

It's already hard enough coding a driver in C. This is just insane I'll tell you that. You're better off just using the C SDK. or if you are feeling adventurous make a a program that'll convert DLLs into ring0 drivers. That's as easy as it can get.

Here's a good setup for you:

Pelles-C IDE (http://www.pellesc.de/index.php?page=download)

WDK (http://msdn.microsoft.com/en-us/library/windows/hardware/gg487428.aspx)

Even better WDK 8 is integrated with Visual Studio. Mad


**Finally these M$ Fuckers did what developers asked.**
Post 10 Jun 2013, 06:42
View user's profile Send private message Reply with quote
Feryno



Joined: 23 Mar 2005
Posts: 454
Location: Czech republic, Slovak republic
Feryno
Hi, if your driver is 32 bit you need kmd.inc
http://board.flatassembler.net/topic.php?t=6541
if it is x64 I can send you KMD64.inc let me know then
kmd will be sufficient for some time, but when your driver becomes larger project you will probably need to download some gigabytes from ms to obtain header files (WDK or visual studio as typedef wrote) and then convert some data into fasm syntax
if you need only few constants/structures then better to search MSDN than download and install gigabytes...
Post 10 Jun 2013, 08:03
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.