address space / opcode generation

Index > Macroinstructions > address space / opcode generation

Author

Thread

blm101

Joined: 21 Jan 2019
Posts: 2

blm101 21 Jan 2019, 08:05

Hi, I hope someone can please help with my problem?

I need FASM to generate a fixed DWORD for all address references.
For example, to write the code

Code:

jmp REF
nop
call REF
nop
mov [REF], eax

I need the binary output of

Code:

0xE9 0x11 0x11 0x11 0x11
0x90
0xE8 0x11 0x11 0x11 0x11
0x90
0xA3 0x11 0x11 0x11 0x11

This is required because address fixups are applied to the code at runtime.
Using the org directive cannot work for me, my code position is variable, and the addresses being referred to are also variable.
I am new to FASM and somewhat lost in the documentation..
Is there a solution?

Thanks!

21 Jan 2019, 08:05

ProMiNick

Joined: 24 Mar 2012
Posts: 804
Location: Russian Federation, Sochi

ProMiNick 21 Jan 2019, 08:43

Code:

macro r [name] {
  macro name [args] {
    \forward
      \local newarg
      newarg equ $11111111  ;constant that you needed in
      match size =[ arg =],args { newarg equ size[$11111111] \\}
      match size =[ ++ arg =],args { newarg equ size[arg] \\}
      match =[ arg =],args { newarg equ [$11111111] \\}
      match =[ ++ arg =],args { newarg equ [arg] \\}
      match ++ arg,args { newarg equ arg \\}
    \common
      name newarg
  \}
}

example

Code:

r mov,jmp,call; and so on all mnemonics that thou planned to patch 
mov dword [456],++eax  ;->mov dword [$11111111],eax
jmp eax;->jmp $11111111
jmp ++eax;->jmp eax
call [eax+4*ebp+8];->call [$11111111]
call [++ebx+2*ecx+4];->call [ebx+2*ecx+4]
;etc..., every operand started from ++ is left unchanged, otherwise is replaced

As thou can see if we declare macro r [any] as {} code in example will stay compilable. Because of that sequence of + is best marker in fasm.
so ++ could change operand to another value, while default value will require for example +++ sequence and so on

Last edited by ProMiNick on 21 Jan 2019, 08:54; edited 1 time in total

21 Jan 2019, 08:43

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8359
Location: Kraków, Poland

Tomasz Grysztar 21 Jan 2019, 08:50

With fasmg you can simply redefine DD directive which in turn is used by instruction encoding macros:

Code:

element REF

macro dword? value
    local v
    v = value
    if v relativeto REF
        emit dword: 11111111h
        ; register fixup here
    else
        emit dword: v
    end if
end macro

macro dd? definitions&
    iterate value,definitions
        match ?, value
            dd ?
        else match n =dup? ?, value
            dd n dup ?
        else match n =dup? (?), value
            dd n dup ?
        else match n =dup? v, value
            repeat n
                dword v
            end repeat
        else
            dword value
        end match
    end iterate
end macro

include 'cpu/p6.inc'
use32

include 'listing.inc'

jmp REF
nop
call REF
nop
mov [REF], eax

This is the listing produced by the above source:

Code:

00000000: E9 11 11 11 11           jmp REF
00000005: 90                       nop
00000006: E8 11 11 11 11           call REF
0000000B: 90                       nop
0000000C: A3 11 11 11 11           mov [REF], eax

The source uses the fasm 1 compatibility macro set plus utility macros, all available on GitHub.

21 Jan 2019, 08:50

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20451
Location: In your JS exploiting you and your system

revolution 21 Jan 2019, 09:48

Near call and jmp are already relative in code so those shouldn't need any fixups.

21 Jan 2019, 09:48

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8359
Location: Kraków, Poland

Tomasz Grysztar 21 Jan 2019, 10:32

revolution wrote:

Near call and jmp are already relative in code so those shouldn't need any fixups.

The above sample assumes that REF is an external symbol (like in object file) and then jumps require relocation, too.

If a simple relocation of local code was needed, it should look more like:

Code:

                                   org REF
                                   start:
00000000: EB FE                    jmp start
00000002: 90                       nop
00000003: E8 F8 FF FF FF           call start
00000008: 90                       nop
00000009: A3 11 11 11 11           mov [start], eax

21 Jan 2019, 10:32

blm101

Joined: 21 Jan 2019
Posts: 2

blm101 21 Jan 2019, 16:50

With Tomasz' macro and fasmg, I have the exact required result

Thank you all for help and contribs!

21 Jan 2019, 16:50

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum