I understand, so would you suggest I push a LoadLibrary and GetProcAddress to the binary chunks?

xoru wrote:

I understand, so would you suggest I push a LoadLibrary and GetProcAddress to the binary chunks?

It only takes a minute or two to code up. And about the same time to debug.

Compare that to how much time you would likely spend coding up and debugging a memory scanning, exception handling, export searching piece of code.

macro init32 {
        USE32
        call _init32_findBase
        _init32_findBase: 
                pop eax
                sub eax, ($ - 1)
        
        push    ebp
        mov     ebp, esp
        sub     esp, 4
        mov     [ebp - 4], eax
        
        data_base equ [ebp - 4]
}    

proc findk32
    PUSH    ESI EDI
    
    XOR     ECX, ECX                    ; ECX = 0     
    MOV     ESI, [FS:ECX + 0x30]        ; ESI = &(PEB) ([FS:0x30])     
    MOV     ESI, [ESI + 0x0C]           ; ESI = PEB->Ldr     
    MOV     ESI, [ESI + 0x1C]           ; ESI = PEB->Ldr.InInitOrder 
    
    next_module:     
        MOV     EAX, [ESI + 0x08]           ; EBP = InInitOrder[X].base_address     
        MOV     EDI, [ESI + 0x20]           ; EBP = InInitOrder[X].module_name (unicode)     
        MOV     ESI, [ESI]                  ; ESI = InInitOrder[X].flink (next module)     
        
        ; check if first char is 'k'
        MOV     CX, 'k'
        CMP     [EDI], CX                   ; modulename[0] == 'k' ?
        JNE     next_module
        
        ; check if second char is 'e'
        MOV     CX, 'e'
        CMP     [EDI + 2], CX               ; modulename[1] == 'e' ?
        JNE     next_module
        
        ; find null char at correct location (kernel32.dll\0)
        XOR     ECX, ECX
        CMP     [EDI + 12*2], CX            ; modulename[12] == 0 ?     
        JNE     next_module                 ; No: try next module.
    
    POP     EDI ESI
    ret
endp

proc findgpa base_address
    PUSH    EBP ESI EDI
    
    MOV     ESI, [base_address]
    
    MOV     EBX, [ESI + 3ch]                ; offset to PE, MZ + 3ch
    MOV     EAX, [ESI + EBX + 78h]          ; export table
    
    MOV     ECX, [ESI + EAX + 4 * 6]        ; number of names
    MOV     EDI, [ESI + EAX + 4 * 7]        ; address table
    MOV     EBX, [ESI + EAX + 4 * 8]        ; name ptr table
    MOV     EBP, [ESI + EAX + 4 * 9]        ; Ordinal table
    MOV     EDX, EBX                        ; EDX = name ptr table
    
    findgpa_nex1:
        MOV     EAX, [ESI + EBX]            ; Get name pointer and search
        
        CMP     DWORD [ESI + EAX], 'GetP'   ; for GetProcAddress in name ptr table
        JE      findgpa_found_getP
        ADD     EBX, 4                      ; try again           
    loop findgpa_nex1
    JMP findgpa_return                      ; give up
    
    findgpa_found_getP:
        CMP     DWORD [ESI + EAX + 4], 'rocA'
        JE      findgpa_found_rocA
        ADD     EBX, 4
        JMP     findgpa_nex1
        
    findgpa_found_rocA:
        CMP     DWORD [ESI + EAX + 8], 'ddre'
        JE      findgpa_found_ddre
        ADD     EBX, 4
        JMP     findgpa_nex1
        
    findgpa_found_ddre:
        SUB     EBX, EDX                    ; Name ptr table offset to GetProcAddress
        SHR     EBX, 1                      ; Ordinals are 'words', adjust for ordinals
        ADD     EBP, ESI
        MOVZX   EBX, WORD [EBP + EBX]       ; Ordinal table offset
        
        SHL     EBX, 2                      ; Back to dword steps
        
        ADD     EBX, EDI                    ; Position in address table worked out from ordinal table
        MOV     EDI, [ESI + EBX]            ; RVA
        ADD     EDI, ESI                    ; EDI = GetProcAddress function
        
        ; ESI = HMODULE to kernel32.dll
        ; EDI = GetProcAddress@8
        MOV     EDX, ESI
        MOV     EAX, EDI
        
    findgpa_return:
    POP     EDI ESI EBP
    ret
endp    

Hi there,

I've been using fASM for a while, and in certain projects with dynamic scripting languages I'm implementing blocks of assembly code to also enable some sort of inline-assembly (after calling a function to assemble the code).

Now, these blocks of code are assembled using the binary format ('format binary'). Is there any way to access Windows API functions from those chunks without pushing pointers to functions on the stack before I execute the block?

format binary has no sections, so I'm curious what I could do.


Also, I'm new to the community, so I'm hoping to learn a lot!

Cheers,
Bas

format binary as "ext"

; structure representing API dependency
; struct
;{
;  DWORD dwDepends; number of DLLS
;  DWORD dwEntryPoint; pointer to block of executable code
;}

; struct {
;    WORD wIndex;   If index < 0, then loading custom DLL
;    DWORD  dwAddress; pointer to address to be filled with appropriate function address 
;    DWORD  pszDLL; pointer to chars containing dll name to load (can be at the end of code)
;    DWORD  pszFunction; pointer to name of function in referenced DLL.
; }

; header
; number of DLLs
dd 2
dd entry_point


; first dll referenced
dw     0   ;   (user32.dll) See table below
dd     fnMsgBox
dd     0  ; not needed. Used table
dd     pszMsgBox

; 2nd dll referenced (Custom, or can also be added to table. You decide)
dw     -1   ;
dd     fnAdd
dd     pszCustomDLL
dd     pszAdd

;; pointers
fnMsgBox dd 0
fnAdd       dd 0

;; code
entry_point:

push   0
push   0
push   0
push   0
call     dword[fnMsgBox]

; add 3+2
push 3
push 2
call   dword[fnAdd]

; ... more code

; data
pszMsgBox db 'MessageBoxW',0
pszAdd       db 'Add',0
pszCustomDLL db 'customlib.dll',0


    

dd dwUser32; ;Index = 0
dd dwKernel32;
...
dwUser32   db 'user32.dll',0
dwKernel32 db 'kernel32.dll',0
    

xoru,

Have you seen alien module? It allows DLL functions to be called from Lua almost directly.

Compile-and-run approach can be implemented as custom FASM.DLL build (with proper Lua bindings) which recognizes special symbols like Kernel32.DLL!GetCommandLineA as a references to external addresses and properly snaps them before execution. Arguments conversion is still non-trivial task (that's why I recommend alien).