flat assembler
Message board for the users of flat assembler.

Index > Main > "fasm manual export"

Author
Thread Post new topic Reply to topic
zxcv
Guest




zxcv
i typed "fasm manual export" on google, 0 results.
So, how can i export functions manualy?
Post 20 Dec 2007, 02:10
Reply with quote
mattst88



Joined: 12 May 2006
Posts: 260
Location: South Carolina
mattst88
I think you're looking for the 'public' keyword.
Post 20 Dec 2007, 02:28
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3050
Location: vpcmipstrm
bitRAKE
Nah, I think he wants to build an export section manually.

I can't recall the format:
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/
Post 20 Dec 2007, 05:39
View user's profile Send private message Visit poster's website Reply with quote
zxcv
Guest




zxcv
bump, need example
Post 23 Dec 2007, 12:48
Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3050
Location: vpcmipstrm
bitRAKE
Well, there is a macro for this. So, how hard could it be to reverse engineer. Much easier than reading a bunch of documentation:
Code:
section '.edata' export data readable

    dd 0,0,0,RVA _errormsg,1
    dd 2,2,RVA errormsg_addresses,RVA errormsg_names,RVA errormsg_ordinals

  errormsg_addresses:
    dd RVA ShowErrorMessage
    dd RVA ShowLastError

  errormsg_names:
    dd RVA _ShowErrorMessage
    dd RVA _ShowLastError

  errormsg_ordinals:
    dw 0
    dw 1


_errormsg db 'ERRORMSG.DLL',0

_ShowErrorMessage db 'ShowErrorMessage',0
_ShowLastError    db 'ShowLastError',0    
This code replaces the export section of the DLL example program of the standard distribution. The macro sorts ordinals and name RVA's based on function strings.

That should be enough to get you coding!
Post 24 Dec 2007, 05:59
View user's profile Send private message Visit poster's website Reply with quote
zxcv
Guest




zxcv
shouldnt be
Code:
dd 0,0,0,0,0    
after
Code:
dd 2,2,RVA errormsg_addresses,RVA errormsg_names,RVA errormsg_ordinals    

I might be wrong, but it would by logical that export work 0-terminated like import.

and for what is
Code:
_errormsg db 'ERRORMSG.DLL',0     
Post 24 Dec 2007, 08:08
Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
zxcv wrote:
shouldnt be
Code:
dd 0,0,0,0,0    
after
Code:
dd 2,2,RVA errormsg_addresses,RVA errormsg_names,RVA errormsg_ordinals    

I might be wrong, but it would by logical that export work 0-terminated like import.
No. Check the documentation.
zxcv wrote:


and for what is
Code:
_errormsg db 'ERRORMSG.DLL',0     
It is the name of the DLL.
Post 24 Dec 2007, 08:23
View user's profile Send private message Visit poster's website Reply with quote
zxcv
Guest




zxcv
Quote:
No. Check the documentation.

I tryed to find it, but in that link http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/ thers nothing!
Google also give me 'excel exports' and other shit. maybe im using wrong queries...

Quote:
It is the name of the DLL.

So if i write there kernel32.dll, ill spoof kernel32? yes?
Post 24 Dec 2007, 08:25
Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
Search for PE or portable executable or something like that when looking for PE exports.
zxcv wrote:
Quote:
It is the name of the DLL.

So if i write there kernel32.dll, ill spoof kernel32? yes?
No, I think the name is ignored by Windows so feel free to put whatever you want there.
Post 24 Dec 2007, 08:35
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3050
Location: vpcmipstrm
bitRAKE
I've heard that you "can lead a horse to water, but can't make him drink." But if I horse told you he was thirsty you'd think he'd at least try the fucking water! Rolling Eyes
Post 25 Dec 2007, 01:58
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
You can lead a horse to water, but can't make him think.
Post 25 Dec 2007, 06:48
View user's profile Send private message Visit poster's website Reply with quote
zxcv
Guest




zxcv
i wont gona learn it, if you spam with google and search.
I cant belive you dont know such basic things. You code under windows, so that should be easy for you. Ohh, im sorry, you use macros. When i know something, and someone ask for it, i never google him, i always try to make him understand untill he say 'ok now i understand, thread can be closed'.
For long time i didnt needed export, untill now. I searched for this topic, and once more tried to understand this.
Code:
  errormsg_ordinals:
    dw 0
    dw 1     

says me nothing
why 0 and 1? WHY? I dont know.

Code:
_errormsg db 'ERRORMSG.DLL',0     

Quote:
No, I think the name is ignored by Windows so feel free to put whatever you want there.

WHY ITS THER IF LOADER IGNORE IT?
Its not ignoring it, so why it works without it? Yea, ask fu **in google =/

Maybe you dont understand me, ok:
my point is to understand how it work, not how to use it. If i would like to write working applications in short time would propably go in c#.

I NEVER ask questions, without googling for answer. Documentation of api is easy to find, and such basic things. But what to do, if sometimes first result is my topic on forum =/ Damn, even if i find something, its written to someone who already know it. Not even 1 example (dd 0,0,0,0,0 -1st is directory table, this is used for..., 2nd is adress table, and so on... ) Im not talking only about pe export, i stuck on many things. Manuals are written for experts! Even for more trivial things, like simple api calls or delphi/c/php syntax (ohh, i just love those php scripts, magic_quotes for some ppl are really magic). On other forum many have this problem. Why? Because their are dumb? No, cuz thers no good source. When i started with programming (php>c) i was total noob, and thought that compiler is that gui program. And didnt even knew how it translate code, ssembler was for me a language like c or c++ but extremly-hard from ppl who write super-programs in 15 minutes or heared from sm1 else. Why? No good source. Howewer i discovered the truth. But now its same thing, no answers>questions>google>no answers>bump>google - infinite loop.
Maybe after spamming 20 forums finally i get answer, this worked before. Or maybe i waste more time searching, asking, and coding shitty programs cuz of low knowleadge. But imho its better to write crap in fasm, than try to find how to add 2 strings in c (lol, i never forget it, i was searching for it few months! Why? Because i didnt know whats memory, and how its stored there). Thats why im trying to understand, then to code. (main reason why i like fasm so much, no usless crap, if i fu*k something program will crash, and i learn whats wrong) In c u understand nothing, null, nil, zero, \x00. Only knowleadge is how to include, loop and use high-level function. If something is wrong, compiler will correct if, thats programming? Thats joke. Why it add tons of usless code? Why simple hello worlsd must have 15 kb? Maybe its good for now, but there should be better language. No optimizations, everything work as it should, loop has always same base. Im even thinking of making such thing, but i need to learn much yet, or it would be another crap, even worst than delphi. I finally resigned from c, when it came to make socket program (dns resolve). It was hardcore for me in c. Then i tried in MASM, same effect. When i learned more, i understood thers no dword, and size_t, but 4 byte argument wich can be adress or direct value (still having problems with '**var'). Microsoft used logic creating their system, c-creators used money and hmm, cant even express it. And some people belive its impossible to learn programming seeing a fuc**ng unsigned const __fastcall crap (*SIZE_STRUCT_PTR)&(*some_func(&(**DWORD_PTR(__something(**inet_ntoa(**var.at_ss_ip[&var3.addr])))))) wich a simple call to inet_ntoa... Even today i was wondering whats wrong with my prog, ofc bad thing from c, i used label like variable -.-. Why? No good source.
I wrote so much, you dont have to read it. Im just tired of searching and finding only my own questions and other shit, i had to say it.


Last edited by zxcv on 14 Jan 2008, 02:59; edited 2 times in total
Post 14 Jan 2008, 02:43
Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
http://win32assembly.online.fr/tutorials.html <- PE Tutorials
http://win32assembly.online.fr/pe-tut7.html <- PE Tutorials - Export Table
http://www.google.com/search?hl=es&q=PE+export+table&meta= Very Happy (And first result is the tutorial above)

Read the whole tutorial and ask questions about it, I think it tells all you need (or must be supplemented a few with the already provided links).
Post 14 Jan 2008, 02:57
View user's profile Send private message Reply with quote
zxcv
Guest




zxcv
ill try (again...) to compare this manual to example from this thread. Maybe i understand it now.

But that example made me laugh, its a joke, right? Respect for this who understand it.

edit:
Quote:
For example, in the above example, the DLL can choose to export the function by ordinal, say, 16.

right, at begining ther refering to that dam example

Quote:
The export structure is called IMAGE_EXPORT_DIRECTORY. There are 11 members in the structure but only some of them are really used.

thats something.
...but i cant find any 11 dwords in bitRAKE's example.

Quote:
What's an ordinal? An ordinal is a 16-bit number that uniquely identifies a function in a particular DLL.

okay, dw 0, dw 1. Each function must have next ordinal (65025 max?)

Quote:
Then the other DLLs/EXEs which want to call this function must specify this number in GetProcAddress.

only? import cant do that?

hmm...
Code:
dd 0,0,0,RVA _errormsg,1
    dd 2,2,RVA errormsg_addresses,RVA errormsg_names,RVA errormsg_ordinals    

=
Code:
dd 0,0,0,RVA _errormsg,1,2,2,RVA errormsg_addresses,RVA errormsg_names,RVA errormsg_ordinals    

?


ok, i wrote this:
Code:
format pe gui
section '.code' code readable executable
abc:
push 0
push 0
push 0
push 0
call [MessageBoxA]
retn
section '.idata' import data readable
dd 0,0,0,RVA user32_name,RVA user32_table
dd 0,0,0,0,0
user32_table:
MessageBoxA dd RVA _MessageBoxA
dd 0
user32_name db 'user32.dll',0
_MessageBoxA db 0,0,'MessageBoxA',0
section '.edata' export data readable
dd 0,1,1,1,RVA _addr,RVA _names,0 ;7 rows in that iczelion table
_addr:
dd RVA abc
_names:
dd RVA _abc
_abc db 'aaa',0
section '.reloc' fixups data discardable    

dont work =/
Post 14 Jan 2008, 03:09
Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3050
Location: vpcmipstrm
bitRAKE
Where are the ordinals in your example? ...and where do you point to them with an address? Did you try to assemble the example I took the time to create instead of just saying it didn't work?

If you need a complete program then just replace the text in the DLL example that comes with FASM with the code I posted. What?...You want me to write you a complete tutorial on exports? Sorry, but I don't know anything - I just reverse engineered the macro that comes with FASM. I don't know the "why it is the way it is." I just know the example I posted works.
Post 14 Jan 2008, 04:21
View user's profile Send private message Visit poster's website Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox
bump
Code:
section '.edata' export data readable
dd 0,0,0,0,1
dd 3,0,RVA e_addr,0,0; 3 - number of exported addreses
e_addr:
dd RVA addr1
dd RVA addr2
dd RVA addr3
...    


and u simply call it by ordinals (1,2,3,...)
Post 19 Feb 2008, 08:36
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.