flat assembler
Message board for the users of flat assembler.

Index > Macroinstructions > Adding struct does not work

Author
Thread Post new topic Reply to topic
DerTobi



Joined: 20 May 2013
Posts: 10
Location: DE
DerTobi
Code:
format PE GUI 4.0
entry start

include 'win32ax.inc'

IMAGE_MZ_SIGNATURE              = 05A4Dh
IMAGE_NT_SIGNATURE              = 04550h
IMAGE_FILE_MACHINE_I386         = 014Ch

struct IMAGE_DOS_HEADER
        e_magic           dw      ? 
        e_cblp            dw      ? 
        e_cp              dw      ? 
        e_crlc            dw      ? 
        e_cparhdr         dw      ? 
        e_minalloc        dw      ? 
        e_maxalloc        dw      ? 
        e_ss              dw      ? 
        e_sp              dw      ? 
        e_csum            dw      ? 
        e_ip              dw      ? 
        e_cs              dw      ? 
        e_lfarlc          dw      ? 
        e_ovno            dw      ? 
        e_res             rw      4 
        e_oemid           dw      ? 
        e_oeminfo         dw      ? 
        e_res2            rw      10 
        e_lfanew          dd      ? 
ends 

struct IMAGE_FILE_HEADER  
        Machine               dw    ? 
        NumberOfSections      dw    ? 
        TimeDateStamp         dd    ? 
        PointerToSymbolTable  dd    ? 
        NumberOfSymbols       dd    ? 
        SizeOfOptionalHeader  dw    ? 
        Characteristics       dw    ?            
ends 


section '.data' data readable writeable

        pFileName               db       'test.exe',0
        pTitle                  db       'Error:',0
        pMsg1                   db       'File not found!',0
        hFile                   dd       ?
        pSize                   dd       ?
        pBytesRead              dd       ?
        pBuffer                 rb       7000h
        dwSections              dw       ?
        dwSizeOfOptionalHeader  dw       ?
        ddAddressOfEntryPoint   dd       ?
        ddImageBase             dd       ?


section '.idata' import data readable

        library kernel32,'KERNEL32.DLL',\
                user32,'USER32.DLL'

        include 'api\kernel32.inc'
        include 'api\user32.inc'

section '.text' code readable executable

   start:
        ; +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        ; + Read file to buffer
        ; +++++++++++++++++++++++++++++++++++++++++++++++++++++++++

        invoke CreateFile, pFileName, GENERIC_READ, FILE_SHARE_READ Or FILE_SHARE_WRITE,0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
        .if eax = INVALID_HANDLE_VALUE
            invoke  MessageBox,NULL, pMsg1, pTitle ,MB_ICONERROR
            invoke ExitProcess, 0
        .endif
        mov [hFile], eax

        invoke  GetFileSize, [hFile], 0 ;
        mov [pSize], eax

        invoke ReadFile, [hFile], pBuffer, [pSize], pBytesRead, 0

        invoke CloseHandle, [hFile]

        call ReadPE
  @Exit:
        invoke ExitProcess, 0
        ret

proc ReadPE

        pushad

        mov esi,pBuffer
        xor edx, edx

      ;  cmp word [esi],IMAGE_MZ_SIGNATURE   ; MZ
      ;  jnz @SubExit
        .if word [esi] <> IMAGE_MZ_SIGNATURE
            jmp @SubExit
        .endif
        ; ESI = MZ

        ; ++++++++++++++++++++++++++++++++++++++++++
        add esi,[esi+IMAGE_DOS_HEADER.e_lfanew]
     ;* is compiled to...
     ;* ADD ESI,DWORD PTR DS:[ESI+3C]

        .if word [esi] <> IMAGE_NT_SIGNATURE  ; PE
            jmp @SubExit
        .endif
     ;* ESI = PE, works here

        ; ++++++++++++++++++++++++++++++++++++++++++
        add edx,dword [esi+IMAGE_FILE_HEADER.Machine]
     ;* is compiled without struct addition here !
     ;* ADD EDX,DWORD PTR DS:[ESI]
     ;* EDX = 00004550 and does exit

        .if word [esi] <> IMAGE_FILE_MACHINE_I386
            jmp @SubExit
        .endif

        nop

@SubExit:
        popad
        ret

endp
     

I want read and save the pe infos of a file, but i fail, esi + struct size does not work.
Post 16 Dec 2013, 13:25
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
DerTobi,

PE signature is a dword value, and it's not a part of IMAGE_FILE_HEADER structure (so you should add 4 before checking .Machine member).
Post 16 Dec 2013, 14:42
View user's profile Send private message Reply with quote
DerTobi



Joined: 20 May 2013
Posts: 10
Location: DE
DerTobi
baldr wrote:
DerTobi,
IMAGE_FILE_HEADER structure (so you should add 4 before checking .Machine member).

Thx baldr but
instead of [esp+4],
i want to write --> [esp+FileHeader.Machine], but i does not work.
And finally I just want to read & save values from obtional header.


NEW EXE
+0 PE
4 WORD Machine;
6 WORD NumberOfSections;
8 DWORD TimeDateStamp;
C DWORD PointerToSymbolTable;
10 DWORD NumberOfSymbols;
14 WORD SizeOfOptionalHeader;
16 WORD Characteristics
Post 16 Dec 2013, 16:32
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
DerTobi,

So what's the problem? After add esi, [esi+IMAGE_DOS_HEADER.e_lfanew] you may either address those fields as [esi+4+IMAGE_FILE_HEADER.field_name], or use virtual directive to give some meaningful names for them:
Code:
        add     esi, [esi+IMAGE_DOS_HEADER.e_lfanew]; now esi points to PE
virtual at esi
  pe_signature rd 1
  file_hdr IMAGE_FILE_HEADER
  optional_hdr IMAGE_OPTIONAL_HEADER
end virtual
        cmp     [pe_signature], IMAGE_NT_SIGNATURE
        jne     @SubExit
        cmp     [file_hdr.Machine], IMAGE_FILE_MACHINE_I386
        jne     @SubExit
;and so on    
Post 16 Dec 2013, 17:35
View user's profile Send private message Reply with quote
DerTobi



Joined: 20 May 2013
Posts: 10
Location: DE
DerTobi
Code:
format PE GUI 4.0
entry start

include 'win32ax.inc'

IMAGE_MZ_SIGNATURE              = 05A4Dh
IMAGE_NT_SIGNATURE              = 04550h
IMAGE_FILE_MACHINE_I386         = 014Ch

struct IMAGE_DOS_HEADER
        e_magic           dw      ? 
        e_cblp            dw      ? 
        e_cp              dw      ? 
        e_crlc            dw      ? 
        e_cparhdr         dw      ? 
        e_minalloc        dw      ? 
        e_maxalloc        dw      ? 
        e_ss              dw      ? 
        e_sp              dw      ? 
        e_csum            dw      ? 
        e_ip              dw      ? 
        e_cs              dw      ? 
        e_lfarlc          dw      ? 
        e_ovno            dw      ? 
        e_res             rw      4 
        e_oemid           dw      ? 
        e_oeminfo         dw      ? 
        e_res2            rw      10 
        e_lfanew          dd      ? 
ends 

struct IMAGE_FILE_HEADER  
        Machine               dw    ? 
        NumberOfSections      dw    ? 
        TimeDateStamp         dd    ? 
        PointerToSymbolTable  dd    ? 
        NumberOfSymbols       dd    ? 
        SizeOfOptionalHeader  dw    ? 
        Characteristics       dw    ?            
ends 

struct IMAGE_DATA_DIRECTORY
        VirtualAddress    dd      ? 
        isize             dd      ? 
ends 

IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 

struct IMAGE_OPTIONAL_HEADER32 
        Magic                         dw       ? 
        MajorLinkerVersion            db       ? 
        MinorLinkerVersion            db       ? 
        SizeOfCode                    dd       ? 
        SizeOfInitializedData         dd       ? 
        SizeOfUninitializedData       dd       ? 
        AddressOfEntryPoint           dd       ? 
        BaseOfCode                    dd       ? 
        BaseOfData                    dd       ? 
        ImageBase                     dd       ? 
        SectionAlignment              dd       ? 
        FileAlignment                 dd       ? 
        MajorOperatingSystemVersion   dw       ? 
        MinorOperatingSystemVersion   dw       ? 
        MajorImageVersion             dw       ? 
        MinorImageVersion             dw       ? 
        MajorSubsystemVersion         dw       ? 
        MinorSubsystemVersion         dw       ? 
        Win32VersionValue             dd       ? 
        SizeOfImage                   dd       ? 
        SizeOfHeaders                 dd       ? 
        CheckSum                      dd       ? 
        Subsystem                     dw       ? 
        DllCharacteristics            dw       ? 
        SizeOfStackReserve            dd       ? 
        SizeOfStackCommit             dd       ? 
        SizeOfHeapReserve             dd       ? 
        SizeOfHeapCommit              dd       ? 
        LoaderFlags                   dd       ? 
        NumberOfRvaAndSizes           dd       ? 
        DataDirectory                             rb (sizeof.IMAGE_DATA_DIRECTORY*IMAGE_NUMBEROF_DIRECTORY_ENTRIES) 
ends 

section '.data' data readable writeable

        pFileName               db       'test.exe',0
        pTitle                  db       'Error:',0
        pMsg1                   db       'File not found!',0
        hFile                   dd       ?
        pSize                   dd       ?
        pBytesRead              dd       ?
        pBuffer                 rb       7000h
        dwSections              dw       ?
        dwSizeOfOptionalHeader  dw       ?
        ddAddressOfEntryPoint   dd       ?
        ddImageBase             dd       ?


section '.idata' import data readable

        library kernel32,'KERNEL32.DLL',\
                user32,'USER32.DLL'

        include 'api\kernel32.inc'
        include 'api\user32.inc'

section '.text' code readable executable

   start:
        ; +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        ; + Read file to buffer
        ; +++++++++++++++++++++++++++++++++++++++++++++++++++++++++

        invoke CreateFile, pFileName, GENERIC_READ, FILE_SHARE_READ Or FILE_SHARE_WRITE,0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
        .if eax = INVALID_HANDLE_VALUE
            invoke  MessageBox,NULL, pMsg1, pTitle ,MB_ICONERROR
            invoke ExitProcess, 0
        .endif
        mov [hFile], eax

        invoke  GetFileSize, [hFile], 0 ;
        mov [pSize], eax

        invoke ReadFile, [hFile], pBuffer, [pSize], pBytesRead, 0

        invoke CloseHandle, [hFile]

        call ReadPE
  @Exit:
        invoke ExitProcess, 0
        ret

proc ReadPE

        pushad

        mov esi,pBuffer
        xor edx, edx

      ;  cmp word [esi],IMAGE_MZ_SIGNATURE   ; MZ
      ;  jnz @SubExit
        .if word [esi] <> IMAGE_MZ_SIGNATURE
            jmp @SubExit
        .endif
        ; ESI = MZ

        ; ++++++++++++++++++++++++++++++++++++++++++
        add     esi, [esi+IMAGE_DOS_HEADER.e_lfanew]; now esi points to PE

        virtual at esi
           pe_signature rd 1
           file_hdr IMAGE_FILE_HEADER
           optional_hdr IMAGE_OPTIONAL_HEADER32
        end virtual

        cmp [pe_signature], IMAGE_NT_SIGNATURE
        jne @SubExit
        cmp [file_hdr.Machine], IMAGE_FILE_MACHINE_I386
        jne @SubExit

        ; does not work here!
        mov word [dwSections], word [file_hdr.NumberOfSections]

        ;works
        ;add ax ,word [file_hdr.NumberOfSections]
        ;mov [dwSections],ax

        nop

@SubExit:
        popad
        ret

end    


Next problem
Post 16 Dec 2013, 20:14
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
DerTobi,

There is no mov mem32, mem32 instruction in Intel x86-32 set. Read CPU manuals.
Post 16 Dec 2013, 20:56
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.