flat assembler
Message board for the users of flat assembler.

Index > Windows > Interesting puzzle

Author
Thread Post new topic Reply to topic
ACP



Joined: 23 Sep 2006
Posts: 204
ACP
Here you can find interesting puzzle:
http://www.pagetable.com/?p=26#comments

It took one second to convert it to FASM so here it is for you to have some fun:
Code:
format PE console
include '.\INCLUDE\win32ax.inc'
.code

start:
      push (0CBh shl 24) or 08h
      call $-1

.end start
    


BTW: IDA can have problems with this code - better use OllyDBG with Code Analysis option.
Post 05 Feb 2007, 15:05
View user's profile Send private message Reply with quote
asmfan



Joined: 11 Aug 2006
Posts: 392
Location: Russian
asmfan
thoughts on code. My varian of doing nothing:
Code:
format PE console
include 'win32ax.inc'
.code 

start: 
        push    04C200h
        call    $-3
        invoke  ExitProcess,0
.end start
    

it cleans the stack.

_________________
Any offers?
Post 05 Feb 2007, 19:31
View user's profile Send private message Reply with quote
ACP



Joined: 23 Sep 2006
Posts: 204
ACP
You actually don't need to call ExitProcess to exit Windows process.
Post 06 Feb 2007, 16:10
View user's profile Send private message Reply with quote
MichaelH



Joined: 03 May 2005
Posts: 402
MichaelH
Very cool but what's the next step? I'd like to see a simple app that could call debugPrint from kernel mode for example.


Last edited by MichaelH on 08 Feb 2007, 02:01; edited 1 time in total
Post 06 Feb 2007, 20:25
View user's profile Send private message Reply with quote
Goplat



Joined: 15 Sep 2006
Posts: 181
Goplat
ACP: Is that supposed to enter ring 0? It doesn't work on XP.
Post 08 Feb 2007, 01:56
View user's profile Send private message Reply with quote
ACP



Joined: 23 Sep 2006
Posts: 204
ACP
Goplat wrote:
ACP: Is that supposed to enter ring 0? It doesn't work on XP.

No - you can't just like that enter from 3 to ring 0. The presented code is a neat trick that uses simple technique for coding instructions as a series of push instruction and pointing EIP into middle of opcode. It also has other use - you can read it on the page with original posting. However the main idea of jumping in the middle of opcode will work on other operating systems as well.
Post 11 Feb 2007, 21:38
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.