flat assembler
Message board for the users of flat assembler.

Index > Main > How to translate word ptr [bp+buffer+10h],id to FASM??

Author
Thread Post new topic Reply to topic
jhonny6721



Joined: 07 Aug 2014
Posts: 26
jhonny6721
Hello, I am learning ASM, but I have a problem: The tutorial page use TASM syntax. I tried to convert the following code to FASM. But, I can't do it.

Code:
checkEXE: cmp  word ptr [bp+buffer+10h],id ; is it already infected?
jnz  infect_exe
    


Thanks for answer(I'm not a native english speaker)

_________________
Мне нравится программирование.
Post 07 Aug 2014, 20:46
View user's profile Send private message Reply with quote
cod3b453



Joined: 25 Aug 2004
Posts: 619
cod3b453
Assuming the original code is correct, you can simply remove the "ptr".
Post 07 Aug 2014, 20:52
View user's profile Send private message Reply with quote
jhonny6721



Joined: 07 Aug 2014
Posts: 26
jhonny6721
Thanks cod3b453!!! I will apply your suggestion.
Post 07 Aug 2014, 20:57
View user's profile Send private message Reply with quote
jhonny6721



Joined: 07 Aug 2014
Posts: 26
jhonny6721
I returned to the forum because my code did not work. I have the following code fragment that not works:

Code:
cmp word [buffer+10h], word [exe_type]
je infect_exe
    


When I try to assembly it with FASM, it says: Invalid Operant.

I don't know why. Can somebody help me???
Post 07 Aug 2014, 21:01
View user's profile Send private message Reply with quote
cod3b453



Joined: 25 Aug 2004
Posts: 619
cod3b453
There's no such instruction encoding for cmp. You will need to make one of those parameters a register.

More information on instructions can be found from Intel Volume 2 or AMD Volume 3 manuals.
Post 07 Aug 2014, 21:05
View user's profile Send private message Reply with quote
jhonny6721



Joined: 07 Aug 2014
Posts: 26
jhonny6721
Thanks. Where I can get that manuals??? From the Official page?? Or there's better manuals out there??
Post 07 Aug 2014, 21:21
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17715
Location: In your JS exploiting you and your system
revolution
You can have:

cmp mem,immediate
cmp mem,reg

But you can't have:

cmp mem,mem ;x86 encoding doesn't support this
Post 07 Aug 2014, 21:22
View user's profile Send private message Visit poster's website Reply with quote
neville



Joined: 13 Jul 2008
Posts: 507
Location: New Zealand
neville
jhonny6721, your 1st post has a very respectable signature, but your 1st and 3rd posts suggest you are learning asm at least partly for the purpose of creating malware, or perhaps mutating existing malware. True?

_________________
FAMOS - the first memory operating system
Post 07 Aug 2014, 23:01
View user's profile Send private message Visit poster's website Reply with quote
jhonny6721



Joined: 07 Aug 2014
Posts: 26
jhonny6721
Revolution, thanks for telling me that it is not possible to compare two variables in memory. And neville, I have to admit that I'm reading some assembly codes, and some of them are about how computer viruses work. I do not do evil purposes, only research

_________________
Мне нравится программирование.
Post 08 Aug 2014, 19:19
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.