flat assembler - FASMARM v1.44 - Cross assembler for ARM CPUs

Index > Non-x86 architectures > FASMARM v1.44 - Cross assembler for ARM CPUs

Goto page Previous 1, 2, 3, 4, 5, 6 ... 31, 32, 33 Next

Author

Thread

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 28 Feb 2006, 00:06

In FASM the "!" character is not special and becomes part of the name for labels and registers. To solve your problem you need to define two EQUates:

Code:

myreg equ r1
myreg! equ r1! ;<-- "!" must be EQUated also
add myreg,r2,r3
ldmia myreg!,{r0,lr}

28 Feb 2006, 00:06

Giant

Joined: 10 Feb 2006
Posts: 14

Giant 04 Mar 2006, 20:38

Sorry, a bit off-topic. Revolution - and others - How much of an effort would it take to get a MIPS assembler up to the same level of functionality as the ARM assembler? The MIPS instruction set is comparable in complexity... Any thoughts?

04 Mar 2006, 20:38

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 05 Mar 2006, 02:00

Quote:

How much of an effort would it take to get a MIPS assembler up ...

Depends on how much checking is required for special cases. Putting in the basic instruction set should be easy and fast. After that only the non-normal and invalid combinations will slow you down.

I recommend you try it if you are keen.

05 Mar 2006, 02:00

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 06 Mar 2006, 10:02

I have added a new attachment to to top of this thread. v1.06, to support FASM 1.65. Just the source code. When FASM 1.66 is released I will updated the main attachement to match.

Since FASM v1.65 is only a development version the code may break if there are any changes in the future, so be aware. I will do my best to fix any such problem if it occurs.

06 Mar 2006, 10:02

Giant

Joined: 10 Feb 2006
Posts: 14

Giant 11 Mar 2006, 23:05

Revolution, I have a problem. The second my application became larger than 4096 bytes, it started doing segmentation faults. It appears that the segfault happens before any of my code is run... I thought it might be some ELF header problem and am hoping that reading this you will say something like "oh, yea, it must be that the executable segment size does not get set"... Or something along those lines.

Anyway, it seems that it has something to do with the elf support. If you can think of an easy fix, please let me know. I am running 1.64 on a gumsitx linux box.

Thanks

11 Mar 2006, 23:05

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 12 Mar 2006, 01:42

Giant: I don't know how to duplicate your problem. All the headers seem to be fine for any file size I generate. BTW the arm code uses the existing ELF generation code included with regular FASM, I only change the header in three places: 1) +12h machine type 2) +24h e_flags 3) image address offset.

The most likely place for a problem would be the image address difference. In the file ARMv6.ASM at line 219 you see this:

Code:

search_and_replace format_elf_exe, <mov [image_base],8048000h>, <mov [image_base],8000h>,        20

Try either removing the line or changing the value 8000h to 8048000h

Code:

search_and_replace format_elf_exe, <mov [image_base],8048000h>, <mov [image_base],8048000h>,     20

Otherwise if could be a difference with e_flags. I copied that value from your previous hex dump. But it is possible that the e_flags value may be different for larger or multi-section files. If you have an existing application >4096 bytes then check the header at +24h to see if the e_flags value is still 0202h.

12 Mar 2006, 01:42

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 04 Apr 2006, 10:25

hi, i'd like to learn ARM syntax for my new work, could you advice what to read, or post some links, examples or so?

thx

04 Apr 2006, 10:25

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 24 May 2006, 14:07

anyone has some example runable on some windows CE - based operating system?

24 May 2006, 14:07

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 24 May 2006, 14:35

Quote:

anyone has some example runable on some windows CE

Yeah, that would be interesting to get some header files and things for WinCE. Pity my only exposure is not with any commercial OS.

24 May 2006, 14:35

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 24 May 2006, 15:07

WinCE API is same as Win32 API, just reduced. even values are exactly the same, and there are some new calls (enumerating flash cards etc.)

you could freely use old header files, just delete some stuff from them (which ones, depends on system you are going to use... if you know WHAT is windows CE)

my problem is with file format. It looks like plain PE file, maybe you should try to allow PEs in FASMARM and we can try it.

PDA emulator for windows is freely avilable at microsoft's, we can test it there.

24 May 2006, 15:07

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 24 May 2006, 16:50

PS: when you allow PE to FASMARM, change subsystem (or however it is called) to WIN CE (value 9)

24 May 2006, 16:50

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 24 May 2006, 17:07

FASMARM already does the PE format, just use 'format pe'. But the subsystem will be set for x86 and there is no support for relocations. So currently you would have to manually change the subsystem with a hex editor and use purely PC relative code. If someone wants to test it and report here then I can update it to set the subsystem automatically but relocations would be coming at a later time.

24 May 2006, 17:07

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 24 May 2006, 20:56

tomasz: is it possible to provide any help here? I mean if you did learn anything about WinCE executables from general-manuals. By fast-inspecting executables (LordPE), it seems only difference is subsystem value,

revolution: there is no Relacation directory in WinCE app. If you can't get one, i can send you some. Unfortunately i am total noob with ARM ASM, so i don't understand any piece of code. And for sure, DO change subsytem to 9, there is no way to use it with original value.

anyway, revolution, magnificent work Wink

24 May 2006, 20:56

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 25 May 2006, 01:49

You will also need to provide a custom stub (if the WinCE has a stub) with 'format pe on ..'.

What is the default load address for an executable, is it the same as Win32 at 0x40000?

Does WinCE support DLL's? If so what is the default load address? Surely a DLL will need a relocation table, otherwise how can a program load more than one at a time.

25 May 2006, 01:49

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 25 May 2006, 07:12

image base is 00010000h.

there is standard MZ header with x86 code.

anyway:

Code:

PE Executable Info Viewer & [Utility] V0.1
(c) Frederic Rouyre <rfr@inter-land.net>


COFF Header Information
-=-=-=-=-=-=-=-=-=-=-=-

Machine ................: 0x1c0 (Arm)
Number of Sections .....: 5
Number of Symbols ......: 0
Ptr to symbol table ....: 0
Size of Optional Header.: 224
Time/Date stamp ........: 0x430a0e6a
Characteristics ........: 0x10f

PE Optional Header Information
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Image Base ................: 0x10000
Entry Point ...............: 0xc744
File Alignment ............: 0x200
Section Alignment .........: 0x1000
Checksum ..................: 0
Base of Code ..............: 0x1000
Base of Data ..............: 0xd000
Magic......................: 0x10b
Major Image Version .......: 0
Minor Image Version .......: 0
Major Linker Version ......: 0x6
Minor Linker Version ......: 0x14
Major OS Version ..........: 0x4
Minor OS Version ..........: 0
Major Subsystem Version ...: 0x3
Minor Subsystem Version ...: 0
Subsystem .................: 0x9
Size of Code ..............: 0xba00
Size of Headers ...........: 0x600
Size of Heap (commit) .....: 0x1000
Size of Heap (reserve) ....: 0x100000
Size of Image .............: 0x699fc
Size of Initialized Data ..: 0x5b400
Size of Uninitialized Data.: 0
Size of Stack (commit) ....: 0x1000
Size of Stack (Reserve) ...: 0x10000
Number of Data Directory ..: 0x10
DLL Characteristics .......: 0

Data Directory Entries
-=-=-=-=-=-=-=-=-=-=-=

Import Table
        RVA  : 0xd028
        Size : 0x50
Resource Table
        RVA  : 0x11000
        Size : 0x589fc
Exception Table
        RVA  : 0x10000
        Size : 0x718
Import Address Table (IAT)
        RVA  : 0xe000
        Size : 0x16c

Section Information
-=-=-=-=-=-=-=-=-=-

Section: 0
        Name .........: .text
        Virtual Addr .: 0x1000
        Virtal Size ..: 0xb97c
        File Ofs .....: 0x600
        Size in file .: 0xba00
        Nbr of relocs.: 0
        Section Characteristics:
                EXECUTABLE
                READABLE
Section: 1
        Name .........: .rdata
        Virtual Addr .: 0xd000
        Virtal Size ..: 0x300
        File Ofs .....: 0xc000
        Size in file .: 0x400
        Nbr of relocs.: 0
        Section Characteristics:
                READABLE
Section: 2
        Name .........: .data
        Virtual Addr .: 0xe000
        Virtal Size ..: 0x1c54
        File Ofs .....: 0xc400
        Size in file .: 0xc00
        Nbr of relocs.: 0
        Section Characteristics:
                READABLE
                WRITABLE
Section: 3
        Name .........: .pdata
        Virtual Addr .: 0x10000
        Virtal Size ..: 0x718
        File Ofs .....: 0xd000
        Size in file .: 0x800
        Nbr of relocs.: 0
        Section Characteristics:
                READABLE
Section: 4
        Name .........: .rsrc
        Virtual Addr .: 0x11000
        Virtal Size ..: 0x589fc
        File Ofs .....: 0xd800
        Size in file .: 0x58a00
        Nbr of relocs.: 0
        Section Characteristics:
                READABLE

Debug & Tests
-=-=-=-=-=-=-

FileSize: 418304
A new section should start at RVA: 0x6a000
A new section should start at File Location: 0x66200
Section Table Offset: 0x1d0, size of section header: 40
In this exe, there is room to add 9 sections

25 May 2006, 07:12

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 25 May 2006, 21:34

I have updated the download in the first post of this topic with v1.07. I set the various parts of the PE header for ARM compatibility, but note: I cannot test it. Check out the ARM exe's for anything amiss.

Due to upload file size restrictions I have only included binaries for Win32 console and GUI, the other binaries can easily be compiled if you need.

Here is a little bonus for FASMARM users, the ARM format template for making your own exe's. The only thing missing are the header files to define all the constants needed for the import tables.

Code:

;Note: this file is provided as a template for how the WinCE PE is constructed.
;Don't try to run the resulting exe, at best it will do nothing, at worst it will crash.

        format  PE GUI
        entry   start

;***********************************************************************************************

section '.text' code readable executable

start:
        code_type.start=32                                      ;32=ARM, 16=THUMB
                stmdb   sp!,{r4-r11,lr}                         ;save some stuff
                sub     sp,sp,0x10                              ;local stack variables (if needed)
                bl      OsFunction1                             ;an imported OS function
                bl      MyProc
                bl      OsFunction2                             ;an imported OS function
        prolog.start:
                add     sp,sp,0x10                              ;restore stack
                ldmia   sp!,{r4-r11,pc}                         ;return

        plength.start=($-prolog.start)/(code_type.start shr 3)  ;calculate length of prolog
        length.start=($-start)/(code_type.start shr 3)          ;calculate length of procedure

        if plength.start > 255
                rb -1 ;prolog length too long
        end if
        if length.start > (1 shl 22)-1
                rb -1 ;procedure length too long
        end if



MyProc:
        code_type.MyProc=32                                     ;32=ARM, 16=THUMB
                ldr     r4,[pc,literals.MyProc-$-8]
                ldr     r3,[r4]
                ldr     r2,[r4,4]
                add     r1,r2,r3                                ;do something useful
                str     r1,[r4,8]
        prolog.MyProc:
                mov     pc,lr                                   ;return

        plength.MyProc=($-prolog.MyProc)/(code_type.MyProc shr 3)       ;calculate length of prolog
        length.MyProc=($-MyProc)/(code_type.MyProc shr 3)               ;calculate length of procedure

        literals.MyProc:
                dw      MyData

        if plength.MyProc > 255
                rb -1 ;prolog length too long
        end if
        if length.MyProc > (1 shl 22)-1
                rb -1 ;procedure length too long
        end if



        ;how to call the imported functions

OsFunction1:    ldr     r12,[pc]
                ldr     pc,[r12]
                dw      _OsFunction1
OsFunction2:    ldr     r12,[pc]
                ldr     pc,[r12]
                dw      _OsFunction2
XFunction1:     ldr     r12,[pc]
                ldr     pc,[r12]
                dw      _XFunction1
XFunction2:     ldr     r12,[pc]
                ldr     pc,[r12]
                dw      _XFunction2

;***********************************************************************************************

section '.rdata' import data readable

        ;this is the import table
        ;*_table must be in the same order as *_imports in the .data section

                dw      RVA core_table,0,0,RVA core_name,RVA core_imports
                dw      RVA dllX_table,0,0,RVA dllX_name,RVA dllX_imports
                dw      0,0,0,0,0

core_table:     dw      0x80000000      ;Function1 constant
                dw      0x80000000      ;Function2 constant
                dw      0
dllX_table:     dw      0x80000123      ;Function1 constant
                dw      0x80000abc      ;Function2 constant
                dw      0
core_name       db      'COREDLL.DLL',0 ;the WinCE equivalent for KERNEL32.DLL
dllX_name       db      'DLLX.DLL',0    ;another DLL

;***********************************************************************************************

section '.data' data readable writeable

data 12

        ;*_imports must be in the same order as *_table in the .rdata section

core_imports:

_OsFunction1    dw      0x80000000      ;Function1 constant
_OsFunction2    dw      0x80000000      ;Function2 constant
                dw      0

dllX_imports:

_XFunction1     dw      0x80000123      ;Function1 constant
_XFunction2     dw      0x80000abc      ;Function2 constant
                dw      0

end data

        ;now we have all our own data and variables

MyData          dw      ?,?,?

;***********************************************************************************************

section '.pdata' data readable

data 3

        ;must be sorted in ascending address order
                dw      start,(0 shl 31) + ((code_type.start shr 5) shl 30) + (length.start shl 8) + (plength.start)
                dw      MyProc,(0 shl 31) + ((code_type.MyProc shr 5) shl 30) + (length.MyProc shl 8) + (plength.MyProc)

end data

;***********************************************************************************************

section '.rsrc' resource data readable

        ;standard resource section, same as x86

                dw      0,0,0,0

Totally untested or verified, but I think it is the general idea. If anyone gets time to make a real file and test it then post your results/susgestions here.

25 May 2006, 21:34

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 25 May 2006, 22:31

... is not a valid pocketPC application.

where did you get info about imports layout?

this seems really interesting:

Code:

http://www.pentest.co.uk/documents/exploringwce/exploring_wce_shellcode.html

25 May 2006, 22:31

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 25 May 2006, 22:52

and this seems even more interesting:
http://www.informit.com/articles/article.asp?p=337071&seqNum=4

25 May 2006, 22:52

sylwek32

Joined: 27 Apr 2006
Posts: 339

sylwek32 26 May 2006, 04:19

Has somebody a MIPS or SH3 version ?
Need this for my PDA / PPC

26 May 2006, 04:19

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 29 May 2006, 08:52

revolution: your example works! you only need to remove DLLX, and change imports from COREDLL to other number, there is no ordinal 0. Do you have any idea how arguments are passed, so i can make some example that really works? for now i was only able to exit, with

Code:

ldr  pc,[lr]

, and i anyway don't understand why lr must be in brackets, if i understand it right, i am doing something like jmp lr in x86 syntax

29 May 2006, 08:52

Goto page Previous 1, 2, 3, 4, 5, 6 ... 31, 32, 33 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum