flat assembler
Message board for the users of flat assembler.

Index > Windows > I'm confused

Author
Thread Post new topic Reply to topic
matefkr



Joined: 02 Sep 2007
Posts: 1291
Location: Ukraine, Beregovo
matefkr 21 Jan 2008, 07:35
I've changed a pe exe header, so code section can contain writeable, executable, shareable, uninitialized, initialized data. I've made the same with all sections, except reloc. After that i've placed a code, in which it rewrite for byte in it with otherone (so it place one or more instruction/s here) depending on the state of a register (so it will give the index to the instruction currently need). The instruction which do that, uses ds (default) seg register. cs is "xx1b" and ds is "xx23" (but it may point to the "same" descriptor) in that point of code (actually, it never changes). Everything worked just fine.

However, i've get some info that in pmode (so windows) descriptors with executable bits are only executable, but also, they can't be writeable. So maybe it depends on the used segment register as well, or windows just handle the rising exception (but i guess not).
Post 21 Jan 2008, 07:35
View user's profile Send private message Reply with quote
AlexP



Joined: 14 Nov 2007
Posts: 561
Location: Out the window. Yes, that one.
AlexP 22 Jan 2008, 02:02
Don't know much about what you're trying to say, I know some interpreted languages allow modifications of their own code, maybe you should check out MSDN, or even better the most recent PE spec's probably has something in there about weird section things like that.
Post 22 Jan 2008, 02:02
View user's profile Send private message Visit poster's website Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7103
Location: Slovakia
vid 22 Jan 2008, 02:04
i think it's not problem of segmentation, it's elsewhere. can you post example code that demonstrates your problem?
Post 22 Jan 2008, 02:04
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
matefkr



Joined: 02 Sep 2007
Posts: 1291
Location: Ukraine, Beregovo
matefkr 23 Jan 2008, 11:24
A little later, now i don't have the file and i can't remember the exact code.
Post 23 Jan 2008, 11:24
View user's profile Send private message Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3174
Location: Denmark
f0dder 23 Jan 2008, 11:50
Protection is done per-page, not through the use of selectors (both code and data are base=0 limit=4g on 32bit windows). So as long as you set the PE section permissions, the windows loader will set the per-page permissions, and you're good to go.

I wouldn't mix "Initialized" and "Uninitialized" though, and why are you adding "Shared"? What you want is Read/Write/Execute/Initialized, nothing more, nothing less.
Post 23 Jan 2008, 11:50
View user's profile Send private message Reply with quote
matefkr



Joined: 02 Sep 2007
Posts: 1291
Location: Ukraine, Beregovo
matefkr 23 Jan 2008, 13:29
It pretty much explains, why could i reach the code segment through ds, but what about rewriteable,and executable code? I could rewrite bytes in the code segment. Also i don't know much about pageing. Is there something in pageing which removes write protection?
Post 23 Jan 2008, 13:29
View user's profile Send private message Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3174
Location: Denmark
f0dder 23 Jan 2008, 14:45
FLAT address space (is, base=0, limit=4gb for code,data,stack descriptors) is why you can "get to code through DS" (which is the default, by the way). Try adding a CS: segment/selector override, and you'll get a protection violation even though the pages are writable.

Paging offers per-page (duh Smile) protection, which is much more granular than the segment protection that you get with selectors (well, descriptors). You can set user/supervisor, read-only/read-write, and (on recent processors) eXecute Disable per page. Pages are typically 4kb large, but (depending on CPU and operating system) can be 2meg, 4meg or 1TB as well.

The Windows PE loader sets per-page permissions according to the PE section flags you specify with fasm or link.exe or a hexeditor or whatever you used.
Post 23 Jan 2008, 14:45
View user's profile Send private message Reply with quote
matefkr



Joined: 02 Sep 2007
Posts: 1291
Location: Ukraine, Beregovo
matefkr 24 Jan 2008, 13:35
So some TYPE flags in the descriptor depends on the used segment register.

Thank you for the help!
Post 24 Jan 2008, 13:35
View user's profile Send private message Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3174
Location: Denmark
f0dder 24 Jan 2008, 15:46
s/segment register/selector.

You can never write to anything with a CS: override, with other selectors it depends on privilige level and paging too, if paging is enabled.
Post 24 Jan 2008, 15:46
View user's profile Send private message Reply with quote
matefkr



Joined: 02 Sep 2007
Posts: 1291
Location: Ukraine, Beregovo
matefkr 28 Jan 2008, 07:15
k. Thanks again!
Post 28 Jan 2008, 07:15
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.