flat assembler
Message board for the users of flat assembler.

Index > Windows > modifying addressess

Author
Thread Post new topic Reply to topic
RauL



Joined: 17 Feb 2005
Posts: 7
RauL
hi guyz, i was just testing something with exes. I compiled the example HELLO project that comes with fasm as it was the most simplest one. Now in order to add a few letters to the message box through hex(using a hex editor like ultraedit), i have to use the empty 00's present. but whenever i add a byte, my exe generates an error cause the entry point of the import changes,
Code:
00000400h: 54 20 00 00 00 00 00 00 00 00 00 00 3C 20 00 00 ; T ..........< ..    

changes to
Code:
00000400h: 00 54 20 00 00 00 00 00 00 00 00 00 00 3C 20 00 ; .T ..........< .    

so i am trying to find in which part of the exe is the address stored that points to this. i want to change it to point to 54 rather than that 00 which it points after adding the byte.ne idea?
[Compile the example proj HELLO that comes with fasm n open it with an hex editor for more info]


Last edited by RauL on 17 Feb 2005, 12:05; edited 1 time in total
Post 17 Feb 2005, 09:16
View user's profile Send private message Reply with quote
JohnFound



Joined: 16 Jun 2003
Posts: 3502
Location: Bulgaria
JohnFound
FASM can use separate sections as well. See for directive "section" in the manual.
Post 17 Feb 2005, 09:40
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
RauL



Joined: 17 Feb 2005
Posts: 7
RauL
yea i do realise that, but now i just want an answer to my previous question..
Post 17 Feb 2005, 11:58
View user's profile Send private message Reply with quote
RauL



Joined: 17 Feb 2005
Posts: 7
RauL
ok, lemme ask it a simple way, is it possible to change the location of
Code:
  library kernel,'KERNEL32.DLL',\
     user,'USER32.DLL'

  import kernel,\
      GetModuleHandle,'GetModuleHandleA',\
     ExitProcess,'ExitProcess'    
(idata) after the exe has compiled?
Post 19 Feb 2005, 02:16
View user's profile Send private message Reply with quote
Madis731



Joined: 25 Sep 2003
Posts: 2140
Location: Estonia
Madis731
Simple answer is NO, but if you really want to do that, you'd have to manually change all references to them and about Messages - they tend to be UNICODE Wink and you have to give it 2-byte pairs so inserting/deleting one byte almost always causes crash.
Another thing is that you cannot INSERT strings when file is already assembled, but you must OVERWRITE so all other bytes remain at the same locations.
Code:
;An example - you can replace:
.H.e.l.l.o...W.o.r.l.d.!......
-with-
.1.2.3.4.5.6.7.8.9.l.d.!......
but you can't change the count of letters in it
    
Post 20 Feb 2005, 10:46
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger Reply with quote
RauL



Joined: 17 Feb 2005
Posts: 7
RauL
i know its possible. i can add bytes but i couldn't find out the reference to the calls. i know i have to change them but which part shld i change(add 2 to the address). cause the address are not relative to file size....
Post 21 Feb 2005, 07:32
View user's profile Send private message Reply with quote
Kecol



Joined: 23 Jan 2005
Posts: 1
Kecol
Raul,


doing it by hand is not easy, and may be imposible. It depends on each program code (not always). Each program is a different world. You must know PE format very good. You must know hex code very good (or use a good disassembler program). It is easier to add another section, than to modify an existing one. This is an example of code with a text message that can not be expanded in an easy way in same section.

Code:
                ...
                jmp    skip_text
my_text         db "This is the text",0
skip_text:      push   my_text
                call     show_msg        ; This proc shows the msg mytext
                ...    


Just an idea: modify the code of HELLO fasm example, replacing the old text with a new one, and then compile it (with a new file name). Then you can open both files with an hex editor and compare them.

Regards.

Kecol.-
Post 21 Feb 2005, 15:05
View user's profile Send private message Reply with quote
RauL



Joined: 17 Feb 2005
Posts: 7
RauL
i created two different variations of hello program(a bit simpler so that the file size would be 1 kb). the differences i found were quite simple, they were just the number of bytes after which .idata's MessageBoxA functions occur etc... thanks for the help. though ur idea to add a new section isnt bad atall, it would be better to place a jmp function in the main code and append the code to be added in the end and jmp to it. so i wont face any address problems. Smile
Post 21 Feb 2005, 16:51
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.