Display the result of a registry addition

Index > Windows > Display the result of a registry addition

Goto page 1, 2 Next

Author

Thread

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 14 Jan 2018, 21:04

Hello,
I'm a new in this forum, in FASM and in another assembly languages Wink

.

I would like to know how we do a calculation in fasm, and that we display the result. I try something like that:

Code:

mov eax, 7
add eax, 3
; Print what's in eax

But is it a good way? And how do you print the result?
I imagine that it's very simple, even that I'm completely stuck ... Please excuse me if it's the case

Thank you Embarassed

!

PS: Forgive me also for my English, it's a little rusty xD

_________________
The best way to predict the future is to invent it.

14 Jan 2018, 21:04

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 14 Jan 2018, 21:58

Hi Mino,

Welcome. Very Happy

There are several ways. Here is one way. See attached .asm file.

Description:	edited	Download
Filename:	integeradd.asm
Filesize:	1.87 KB
Downloaded:	542 Time(s)

14 Jan 2018, 21:58

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 15 Jan 2018, 17:09

Thank you very much yeohhs Very Happy

The code works perfectly, it remains for me to "study" and understand it to reproduce it without having to copy / paste.
If I still have questions about this code, I will post them on this thread, since they will be linked.
Good evening

15 Jan 2018, 17:09

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 16 Jan 2018, 03:11

You're welcome, Mino. Smile

Sure, do post if you more questions. Good evening to you too.

By the way, you can also see the contents of all registers and more details in a debugger.

16 Jan 2018, 03:11

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 17 Jan 2018, 20:26

Hello again,
I just want to ask you a little question, I use this code to generate a loop (normally infinite) that displays "hello":

Code:

format PE Console 
include 'stdlib.inc' ; A file contain all I need (with the idata section + libs)
entry main
section '.rdata' data readable
   val db "hello", 10, 0
section '.code' code executable
   main:
      @@:
         push ecx
         push val
         call [printf]
         pop ecx
         sub ecx, 1
         jnz @B
call [ExitProcess]

(Tell me if there are bad things to fix)

The program, once compiled, works and displays so loop "hello". However, after x iterations, the program stops and it crashs.
Why Sad

17 Jan 2018, 20:26

Furs

Joined: 04 Mar 2016
Posts: 2507

Furs 17 Jan 2018, 21:36

printf is a "vararg" function (takes a variable number of arguments), which doesn't pop the args by itself. You'll have to do that yourself. So you will run out of stack space (each loop iteration pushes 'val' and never pops it).

Also, use dec ecx instead of sub ecx, 1 Wink

Code:

format PE Console 
include 'stdlib.inc' ; A file contain all I need (with the idata section + libs)
entry main
section '.rdata' data readable
   val db "hello", 10, 0
section '.code' code executable
   main:
      @@:
         push ecx
         push val
         call [printf]
         pop ecx  ; just a dummy pop, smaller than add esp, 4 in encoding
         pop ecx  ; restore ecx
         dec ecx
         jnz @B
call [ExitProcess]

Note that "cdecl" functions also have the same calling convention as printf (i.e. you have to clean the stack). However, most Windows API functions clean it themselves, but always keep in mind if needed. Smile

BTW it's not an infinite loop at all, as you don't know the value of 'ecx' and never set it, or am I missing something? It will have whatever the Windows PE loader places in ecx.

17 Jan 2018, 21:36

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 17 Jan 2018, 23:28

Furs wrote:

printf is a "vararg" function (takes a variable number of arguments), which doesn't pop the args by itself. You'll have to do that yourself. So you will run out of stack space (each loop iteration pushes 'val' and never pops it).

Yes.

To make the loop infinite, I suppose you had to set ECX to a non-zero value somewhere. And if you preserve that value, never change it or never allow it to be changed, jnz @B will always be true.

About loops, Kip Irvine wrote:

Quote:

A common programming error is to inadvertently initialize ECX to zero before beginning a loop. If this happens, the LOOP instruction decrements ECX to FFFFFFFFh, and the loop repeats 4,294,967,296 times! If CX is the loop counter (in real-address mode), it repeats 65,536 times.

17 Jan 2018, 23:28

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20344
Location: In your JS exploiting you and your system

revolution 18 Jan 2018, 01:28

Furs wrote:

Also, use dec ecx instead of sub ecx, 1

Just use loop.

18 Jan 2018, 01:28

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 18 Jan 2018, 19:11

Good evening, and thank you for all your answers!
I applied your advice, however I still have 2 questions:
1) What is loop ?
2) If the assembler, here FASM, is supposed to be very fast, why a simple program coded in VB.NET gets to go faster than the code you post?
Here it is :

Code:

Console.WriteLine("hello")

The difference is not huge, but we know how to distinguish it even with the naked eye

Thank you in advance Very Happy

18 Jan 2018, 19:11

Furs

Joined: 04 Mar 2016
Posts: 2507

Furs 18 Jan 2018, 20:26

Because you use printf? Just because you use asm doesn't mean that the functions you call are optimized, it's the exact same printf that you use in C or C++ because you link to the same library (msvcrt.dll or whatever).

And of course, asm needs some effort to be fast, as a beginner you should just focus on learning it. There's no point optimizing for micro-architectural stuff when you're a beginner, you'll just confuse yourself, just do some simple guidelines.

Also, loop is an instruction.

I mean, asm is what the CPU executes sort of. So only instructions (and some macro stuff depending on assembler) are part of the "language". printf is just a function in a library (DLL), not part of the "language" unlike in HLLs (but they ultimately compile to asm ofc, unless they're managed code).

There's no "print" instruction since the CPU has nothing to do with that. That's part of the Operating System, so you use an OS function to write to the screen.

18 Jan 2018, 20:26

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 18 Jan 2018, 21:10

Thank you for the explanations and for the link.
I already knew that printf was the same as in C, and that the asm uses the system's dll for this task, but it's always good to call it back.

Indeed, I'm going to focus on learning, before thinking about optimizations, but it was simply out of curiosity Smile

18 Jan 2018, 21:10

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 18 Jan 2018, 23:50

Mino wrote:

I already knew that printf was the same as in C, and that the asm uses the system's dll for this task, but it's always good to call it back.

If you are only printing out plain strings, you can use puts, another C function. Smile

18 Jan 2018, 23:50

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 20 Jan 2018, 10:25

And what are the differences between puts and printf?

20 Jan 2018, 10:25

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20344
Location: In your JS exploiting you and your system

revolution 20 Jan 2018, 10:34

printf will "format" the string with parameters.

Code:

ccall printf,"Value is %i",[some_value]
;output:
Value is 42

Whereas I assume puts simply prints the string without formatting.

Code:

ccall puts,"Value is %i"
;output:
Value is %i

Last edited by revolution on 20 Jan 2018, 10:42; edited 1 time in total

20 Jan 2018, 10:34

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 20 Jan 2018, 10:37

Mino wrote:

And what are the differences between puts and printf?

There is an interesting discussion about this on stackoverflow.com. Smile

https://stackoverflow.com/questions/2454474/what-is-the-difference-between-printf-and-puts-in-c

20 Jan 2018, 10:37

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 20 Jan 2018, 15:13

Thank you very much for this help, and for the link!

20 Jan 2018, 15:13

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 20 Jan 2018, 16:22

Would any of you know a good course or tutorial, complete if possible, on fasm? Because documentation and internet research is good, but learning for real is better Razz

In fact, I have a pretty big project to do in C++, and I need to use an assembler, fasm seems to me the most suitable, but it seems to me little known (which does not matter in ), but I would like to know where I could learn concretely without making stupid mistakes. I would like to well start, but not too fast either xD

Thank you in advance, you have really helped me so far!

20 Jan 2018, 16:22

yeohhs

Joined: 19 Jan 2004
Posts: 195
Location: N 5.43564° E 100.3091°

yeohhs 21 Jan 2018, 04:50

Hi Mino,

I'm not aware of any course or tutorial that teaches assembly language programming with fasm. There is a book, "Mastering Assembly Programming" by Alexey Lyashko that uses fasm.

There is also another book. It is "Assembly Language for x86 Processors (7th Edition)" by Kip R. Irvine. He uses MASM and covers both 32-bit and 64-bit programming.

Here is a link to a brief article about fasm versus MASM
https://www.xenoinc.org/xi.wiki/index.php?title=FASM_versus_MASM

21 Jan 2018, 04:50

Ali.Z

Joined: 08 Jan 2018
Posts: 719

Ali.Z 21 Jan 2018, 10:58

Furs wrote:

Because you use printf? Just because you use asm doesn't mean that the functions you call are optimized, it's the exact same printf that you use in C or C++ because you link to the same library (msvcrt.dll or whatever).

you sure both use msvcrt.dll
for sure i dont have to ask and i can directly do the reverse process, but the laziness, man!.

_________________
Asm For Wise Humans

21 Jan 2018, 10:58

Mino

Joined: 14 Jan 2018
Posts: 163

Mino 21 Jan 2018, 11:10

Thank you very much for the reference of the book! I found a full equivalent PDF.

21 Jan 2018, 11:10

Goto page 1, 2 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum