64 bit template start.

Index > Windows > 64 bit template start.

Author

Thread

catafest

Joined: 05 Aug 2010
Posts: 129

catafest 15 Jan 2017, 23:51

I start with this template and I have some questions:

Code:

format PE64 GUI 4.0
entry start
include 'win64a.inc'
;---
section '.text' code readable executable
start:
mov rax,3c5677h ; 
push rbp        ; 
mov rbp,rsp     ;
push rax        ;
;--
;--
xor rcx, rcx ; pass an ExitCode of 0 to ExitProcess
call [ExitProcess]
;---
section '.idata' import data readable writeable
library kernel32,'KERNEL32.DLL'
import kernel32, ExitProcess,'ExitProcess'
section '.data' data readable writeable
oldcw   dw   ?
data fixups
end data

The issue is to make one good template of 64 bit assembly language.
1. starting with load rax is a good start ? any idea to start that more to machine language?
2. I used data fixups to generates relocation information, but this is good practice?
3. The end data close the data , this is good way?
4 how about idata and edata works into 64 bit fast program?
Thank you. Regards.

15 Jan 2017, 23:51

catafest

Joined: 05 Aug 2010
Posts: 129

catafest 23 Jan 2017, 00:06

nobody ? my questions are not good ?

23 Jan 2017, 00:06

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20344
Location: In your JS exploiting you and your system

revolution 23 Jan 2017, 12:16

There are already 64-bit templates in the fasm download. What is it that you found was missing that you needed to add?

23 Jan 2017, 12:16

catafest

Joined: 05 Aug 2010
Posts: 129

catafest 29 Jan 2017, 21:45

revolution wrote:

There are already 64-bit templates in the fasm download. What is it that you found was missing that you needed to add?

Yes I know FASM come with 64-bit templates.
I take a look at System V ABI (learning) how it's working.
Also I found this code on internet ( someting strange for me):

Code:

start:
mov rax,3c5677h ; 
push rbp        ; 
mov rbp,rsp     ;
push rax        ;

This put me some questions about memory and virtual memory tasks.
I asked about if that is a good point to start the 64x file versus System V ABI or that has a bad practice.

29 Jan 2017, 21:45

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum