Hello guys,

How can I import a DLL by hand?
(Without using the Import macro)

I would like to call MessageBoxA From User32, do I have to call the DLL or can I use a LIB?


Also, how can I compile my project as a .LIB so I can later on Import in my programs under other languages. Also, how can I import a .LIB in FASM? when I use the 'Import' macro, is fasm importing from a LIB which then calls the DLL or how does it work?.

Thanks in the meantime

Hello, and welcome to the FASM board!

FASM does not use LIB files. The "import" macro imports functions directly from DLLs, and does no checking whether it actually exists within the DLL. Unfortunately, FASM is also incapable of producing LIB files as output, only plain DLLs.

(About your first question, search the message board for a topic called "Optimizing Hello World", there were manual imports there.)

Hi, thanks for the welcome and the answer as well!.

So you can not use a LIB in FASM, is this a linkers job?
How could I go on using a lib in FASM?
Or it is not possible?

I will look about those topics though

Exactly - you need a linker for this. And to make fasm generate the files that linkers can recognize, use the COFF or ELF output format (depending on what linker you decide to use).

Tomasz, What linkers can I use that are Freeware?.
What are the pros and cons of COFF and ELF?.

Provided with the MASM32 package, as well as the Microsoft Visual C++ Express Edition (dunno about EE packages), is an incremental linker "link.exe". Also, the "GoLink" linker is available for free from http://www.jorgon.freeserve.co.uk/ . Also, there is Alink ( http://alink.sourceforge.net/ ).

Licensing issues might keep you away from the Microsoft linker and the MASM32 package... I'd suggest looking into Pelle Orinious "polink" instead.

Is it hard to write a linker if not??

I cant find polink anywhere but can i use POLINK for whatever i want without paying??

I think it is hard to write a linker.

Look at Pelles C package.

more for first question;
You can use LoadLibraryA/GetProcAddress for using dlls more dynamically.

But you need to import LoadLibrary and GetProcAddress

if you really want to have some gain from using these, then you should also use UnloadLibrary

i remember that there is a way to calculate the entry point of
LoadLibraryA/GetProcAddress but y don't remember where i readed
can someone give a link or some hint?

You can depend on a couple of undocumented things to get the kernel32 base address, then manually scan it's export table. Your own GetProcAddress needs to, at the very minimum, support forwarded exports and ordinals; it really should also do binary search and bound imports, unless you want it to be slower than the regular GetProcAddress.

Also note that you must have at least one import that ends up importing from kernel32 if you want your executable to run on all windows versions.

you could search entire memory for export table exporting "GetProcAddress", this is slow, but could be very reliable way...

Hi, I do this for whatever I want in Kernel32.dll:

When your program start, the dword pointed by esp (dword [esp]) is an address in kernel.dll file. Need some knowlege about PE file format can help you import by hand. Look at this code:

;program start
mov eax,[esp]
and eax,0xFFFFF000
mov ecx,0x100
_loop_:
mov bx,word [eax]
cmp bx,word 'MZ'
je may_be_kernel_base
_next_:
dec eax,0x1000 ; section alignment
loop _loop_

Cant_found_kernel:
;when you here, you were fail, so should return to system

may_be_kernel_base:
mov ebx,[eax+0x3C]
add ebx,eax
cmp word[ebx],'PE'
jne _next_

Ok_kernel_base_now_in_eax:
;Here you had kernel base address in eax
;Please check PE format to find out the Export section
;You can search for function's name, or only LoadLibrary,UnloadLibrary
;and GetProcAddress


Oh this is wrote from my memory, may be have error in it. But this only a suggestion !
Goodluck everybody !

For Masm32 package: www.masm32.com
For golink: www.download.int3.net

Negative. It might end up crashing because of page permissions or memory holes - so at least needs SEH. Would be more reliable to use the dword-at-ESP-at-program-startup method, even if it's not guaranteed this will keep working.

of course that with SEH....

You people are crazy.

Look in the PEB for the kernel32 base, from there you can enumerate the EAT. kernel32.dll is always loaded by a PE. kernel32.dll handle will always be in PEB. If there is an EAT it will always be in the PE header, which you can successfully navigate from the module handle which is the base address.



You can do the same for ntdll.dll and etc. Very easy way to have an empty IAT without the need of some packer (be careful on win2k with this, you need atleast 1 valid import).

I also recommend POLINK.