Short blip of MASM code that I need converted to fASM

Index > Windows > Short blip of MASM code that I need converted to fASM

Author

Thread

StakFallT

Joined: 19 Jan 2006
Posts: 50

StakFallT 04 Jun 2006, 12:54

Most of my posts have been really long winded so I'll keep it short for a change Razz

I need this (MASM format):

Code:

HookAPICall proc uses esi edi psDllHook:ptr sDllHook

sDllHook Declaration (MASM format):

Code:

sFunctionHook struct 
        hFuncName DWORD ?
        hHookFunc DWORD ?
        ordinal DWORD ?
        OrignalFunc DWORD ?
        iDefault BOOL ?
sFunctionHook ends
sDllHook struct
        DllName DWORD ?
        sHook sFunctionHook <>
sDllHook ends

Converted into fASM.. I have sDllHook declared as:

Code:

struc sFunctionHook
{
  .:
  .hFuncName dd ?
  .hHookFunc dd ?
  .ordinal dd ?
  .OriginalFunc dd ?
  ;.iDefault BOOL ?
  .iDefault db ?
}
virtual at 0
   sFunctionHook sFunctionHook
end virtual

struc sDllHook
{
  .:
  .DllName dd ?
  ;.sHook sFunctionHook <>
  .sHook sFunctionHook
  ;.size = $ - .
}
virtual at 0
   sDllHook sDllHook
end virtual

My attempted conversion of the proc line:

Code:

proc HookAPICall psDLLHook

Code compiles fine, but yields an error when the dll is utilized from vb, I've narrowed it down to the proc line..

-- StakFallT

04 Jun 2006, 12:54

Vasilev Vjacheslav

Joined: 11 Aug 2004
Posts: 392

Vasilev Vjacheslav 05 Jun 2006, 07:27

Code:

proc HookAPICall uses esi edi psDllHook

struct sFunctionHook
        hFuncName dd ?
        hHookFunc dd ?
        ordinal dd ?
        OrignalFunc dd ?
        iDefault db ?
ends
struct sDllHook
        DllName dd ?
        sHook sFunctionHook
ends

05 Jun 2006, 07:27

StakFallT

Joined: 19 Jan 2006
Posts: 50

StakFallT 08 Jun 2006, 03:44

Well the part that concerned me is the proc line I noticed you have it in there as

Code:

proc HookAPICall uses esi edi psDllHook

Couple of questions come to mind.
Problem 1: This statement would imply psDllHook is still declared as a DWORD size wouldn't it?
Problem 2:Even if we managed to get it set to the size of sDllHook, I think the ptr

Code:

HookAPICall proc uses esi edi psDllHook:ptr sDllHook

throws a monkey wrench into the mix as it's not just a straight "this object is of size <blahblah>" it becomes a "this object is pointed to this object whose size is already declared elsewhere". Which is why when I shown my attempt, I was careful to throw in the word "attempt" because I'm almost certain the one I made isn't correct.. :/

-- StakFallT

08 Jun 2006, 03:44

madmatt

Joined: 07 Oct 2003
Posts: 1045
Location: Michigan, USA

madmatt 08 Jun 2006, 06:43

Code:

proc HookAPICall uses esi edi psDllHook 

struct sFunctionHook 
        hFuncName dd ? 
        hHookFunc dd ? 
        ordinal dd ? 
        OrignalFunc dd ? 
        iDefault db ? 
ends 
struct sDllHook 
        DllName dd ? 
        sHook sFunctionHook 
ends

get to your data using this method:

Code:

;load a register with a pointer to the sDllHook structure data
mov     ecx, [psDllHook]
;access data element within this structure
mov     eax, [ecx + sDllHook.DllName]
- or -
mov     eax, [ecx + sDllHook.sHook.ordinal]

08 Jun 2006, 06:43

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum