macro m_start name
{
  name:
  virtual at 0
}

macro m_end
{
 local m_end_internal
 local nonvirt_bytes
  align 4
  m_end_internal:
  db 0 ; fake align-end marker

  m_size_in_dwords EQU m_end_internal/4

  rept 10000 x1:0
  \{
    if x1 < m_size_in_dwords
     load d_\#x1 dword from 4*x1
    end if
  \}

  end virtual

 nonvirt_bytes:
  rept 10000 x2:0
  \{
    if x2 < m_size_in_dwords
     dd d_\#x2
    end if
  \}
}

m_start cipher
db 255, 254, 253, 252, 251
db 9000 dup(0xaa)
m_end

m_start cipher2
db 7, 8, 9, 10, 11, 12, 13, 14, 15
m_end


    

rept m_size_in_dwords x:0 
    

Those RSA macros you refer to assume that encrypted section will reside in the code.

the only problem is that the following does not work, however "m_size_in_dwords" is known value while REPT is invoked

My intent is to create open and closing macros to prepare structured data inside and encrypt on demand with ability to reject some, calculate crc32, or whatever

in-place data modification is not acceptable for me because mentioned macro can potentially reject all data between opening and closing section

In my approch I'm able to allocate that datablock whereever I like, even on stack in runtime

Well, this is not possible without knowing the data at compile-time. So it should still be encoded somewhere in the program

format PE console
include 'win32ax.inc'

macro m_start name
{
  name:
  push eax
  mov eax, esp
  virtual at 0
}

macro m_end
{
 local m_end_internal
 local nonvirt_bytes
  align 4
  m_end_internal:
  db 0 ; fake align-end marker

  m_size_in_dwords EQU m_end_internal/4

  rept 20000 x1:0
  \{
    if x1 < m_size_in_dwords
     load d_\#x1 dword from 4*x1
    end if
  \}

  end virtual

 nonvirt_bytes:
  rept 20000 x2:0
  \{
    if x2 < m_size_in_dwords
     push dword d_\#x2
    end if
  \}

}

start:

m_start cipher
db 0xff, 0xfe, 0xfd, 0xfc, 0xfb
db 10 dup(0xaa)
m_end

 ; use data on stack [esp...eax]
 mov esp, eax
 pop eax

m_start cipher2
db 7, 8, 9, 10, 11, 12, 13, 14, 15
m_end

 ; use data on stack [esp...eax]
 mov esp, eax
 pop eax


start_next:
        invoke  ExitProcess, 0

.end start
    

... are there any FASM compiler memory limitations? Just took a quick look at FASMW process and it's a 32-bit process. Why not set FASM compiler memory to 3GB threshold and have fun?

Sure, it should be encoded, it resides between opening and closing sections.

format PE console
include 'win32ax.inc'

match,
{
    local ..start
    macro m_ \{ ..start: \}

    macro _m
    \{  
        local ..as,cbMem,cbCod,buf
        cbMem = $ - ..start
        rb cbCod-cbMem
        ..as::
        virtual
            repeat cbMem/4+1
               load buf dword from ..as:..start+(%-1)*4
               push buf 
            end repeat
            cbCod = $-$$
            repeat cbCod
               load buf byte from $$+%-1
               store byte buf at ..as:..start+%-1
            end repeat
        end virtual
    \}  
}


start:
   push ebp
   mov ebp,esp
      m_
         db $FF,$FE,$FD,$FC,$FB
         db 10 dup $AA 
      _m
   leave
   ret 
.end start    

Just took a quick look at FASMW process and it's a 32-bit process. Why not set FASM compiler memory to 3GB threshold and have fun?

But I don't think your solution is flexible. [...] Let's try to comment out your "push" and then try to comment out "push" in previously suggested code with a fixed hardcoded rept cycles.

It's good enough just for proof of concept only.

Obviously you'll need to track rb XXX size, so after changing code logic you'll have two bound code chunks instead of one.

but you have to create placeholder first and track its size (in your implementation RB xxx ...) which is not the case with fixed rept implementation

Actually I don't care how sloopy the macro is and how much time and memory it takes to compile that, bacause the only thing which really matters is a byte sequence produced by FASM.

I don't want to discuss pros and cons of in-place modification now

I appreciate L_INC's effort in helping me to aviod "out of memory" issue but I can afford to add extra 32GB onboard )))

format PE console

include 'win32ax.inc'

; --- nonvirt addr spc ---
as111::


macro m_start4 name
{
  name:
  mov eax, esp
  virtual at 0
}

macro m_end4 name
{
 local nonvirt_bytes, data_end_internal, code_end_internal

  align 4 

  data_end_internal:
  data_size_in_dwords = data_end_internal/4

  ; prolog template
  push edx
  mov edx, esp
  sub esp, 118

  ; repeating data template
  repeat data_size_in_dwords
    load dt1 dword from (%-1)*4
    push dword dt1
  end repeat

  ; epilog template
  mov esp, edx
  pop edx
  ret

  code_end_internal:
  code_size_in_bytes = code_end_internal - data_end_internal

  repeat code_size_in_bytes
    load bt111 byte from data_end_internal + (%-1)
    store byte bt111 at as111:st111 + (%-1)
  end repeat

  end virtual

; --- nonvirt bytes ---

nonvirt_bytes:
  rb code_size_in_bytes
}


st111:
; --- private section ---
m_start4 cipher1
db 3, 4, 5, 6, 1, 1, 1, 1, 0xfd, 0xfc, 0xfb
db 10 dup(0xaa)
m_end4 cipher1


start:
   call st111

   invoke  ExitProcess, 0

.end start
    

My next approach is to create private section where a part of code is declared in virt block

Address space labels keep their offsets so your label is not at offset zero but instead at the PE load address in the first section

; --- private section --- 
  m_start4 cipher1
  db 3, 4, 5, 6, 1, 1, 1, 1, 0xfd, 0xfc, 0xfb
    .x1 dd -1.1
    .x2 dd -2.2
    db 10 dup(0xaa) 
  m_end4 cipher1 
.....
 mov ebx, [esp + cipher1.x1]
 call [ebp + cipher1.x2]