flat assembler
Message board for the users of flat assembler.

Home Search Register
Log in to check your private messages Log in

Index > Windows > thread in dll?
Author
Thread Post new topic Reply to topic
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 24 Jan 2008, 15:27
i tried to create thread in dll (dll call CreateThread).
But it crashed.
Code:
format pe dll
entry start
section '.code' code readable executable
start:
push 0
push 0
push 0
push thread
push 0
push 0
call [CreateThread]
retn
thread:
push 0
push 0
push 0
push 0
call [MessageBoxA]

What i did wrong? Address space is same, no VirtualProtect needed. Help!
Post 24 Jan 2008, 15:27
View user's profile Send private message Reply with quote
MHajduk



Joined: 30 Mar 2006
Posts: 6115
Location: Poland
MHajduk 24 Jan 2008, 15:31
Code:
(...)
call [MessageBoxA]
ret
Question
And where is the import section of this DLL?
Post 24 Jan 2008, 15:31
View user's profile Send private message Visit poster's website Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 24 Jan 2008, 15:42
ffs
Code:
format pe dll
entry start
section '.code' code readable executable
start:
push 0
push 0
push 0
push thread
push 0
push 0
call [CreateThread]
retn
thread:
push 0
push 0
push 0
push 0
call [MessageBoxA]
retn
section '.idata' import data readable
dd 0,0,0,RVA kernel32_name,RVA kernel32_table
dd 0,0,0,RVA user32_name,RVA user32_table
dd 5 dup 0
kernel32_table:
CreateThread dd RVA _CreateThread
dd 0
user32_table:
MessageBoxA dd RVA _MessageBoxA
dd 0
kernel32_name db 'kernel32.dll',0
user32_name db 'user32.dll',0
_MessageBoxA db 0,0,'MessageBoxA',0
_CreateThread db 0,0,'CreateThread',0
section '.reloc' fixups data readable discardable
Post 24 Jan 2008, 15:42
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 24 Jan 2008, 15:47
http://msdn2.microsoft.com/en-us/library/ms682583(VS.85).aspx
That function is the entry point of a DLL and it is stdcall but you implemented it as C (used plain ret instead of ret 12)
Post 24 Jan 2008, 15:47
View user's profile Send private message Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 24 Jan 2008, 16:07
okay, ill remember that.
But what i dont know that cause this crash? Thread is creating, but it seems at wrong address. How should i do that?
Post 24 Jan 2008, 16:07
View user's profile Send private message Reply with quote
OzzY



Joined: 19 Sep 2003
Posts: 1029
Location: Everywhere
OzzY 24 Jan 2008, 16:25
What is RVA?
Post 24 Jan 2008, 16:25
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 24 Jan 2008, 17:06
Quote:

What is RVA?

Relative Virtual Address.

Quote:

But what i dont know that cause this crash? Thread is creating, but it seems at wrong address. How should i do that?


In fact the fault is at the caller of DllMain since you give to it an unbalanced stack and when it return the return address will be an unpredictable value (can be the saved value of EBX, ESI, EDI, or a parameter, or a local variable, etc).

Anyway, have you did the changes already?

You have to change:
Code:
call [CreateThread] 
retn
To
Code:
call [CreateThread] 
retn 12
Post 24 Jan 2008, 17:06
View user's profile Send private message Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Jan 2008, 07:12
ive changed this retn, and it worked somehow... It create threads untill have memory, i have to reset my pc Confused
Post 25 Jan 2008, 07:12
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 25 Jan 2008, 14:57
Perhaps the thread is created multiple times because your entry point forgots to process at PROCESS_ATTACH only?
Post 25 Jan 2008, 14:57
View user's profile Send private message Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Jan 2008, 16:01
Code:
format pe dll
section '.code' code readable executable
entry $
push 0
push 0
push 0
push thr
push 0
push 0
call [CreateThread]
push -1
call [Sleep]
thr:
;jmp $
push 0
push 0
push 0
push 0
call [MessageBoxA]
section '.idata' import data readable
dd 0,0,0,RVA kernel32_name,RVA kernel32_table
dd 0,0,0,RVA user32_name,RVA user32_table
dd 5 dup 0
kernel32_table:
CreateThread dd RVA _CreateThread
Sleep dd RVA _Sleep
dd 0
user32_table:
MessageBoxA dd RVA _MessageBoxA
dd 0
kernel32_name db 'kernel32.dll',0
user32_name db 'user32.dll',0
_MessageBoxA db 0,0,'MessageBoxA',0
_Sleep db 0,0,'Sleep',0
_CreateThread db 0,0,'CreateThread',0
section '.reloc' fixups data readable discardable


i used jmp $, and checked if it take 50% of my cpu - no.
i user process explorer to check if it created a thread - yes

So, it created a thread, but in wrong address. I even tried to export it - do effect.
Post 25 Jan 2008, 16:01
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 25 Jan 2008, 16:46
The thread cannot start till you return from DllMain because every DLL must be called with DLL_THREAD_ATTACH before the thread can run.

BTW, you forgot ret 4 after call [MessageBoxA]

Code:
include 'win32a.inc'
format pe dll
section '.code' code readable executable 
entry $

cmp dword [esp+8], DLL_PROCESS_ATTACH
jne .exit

push 0 
push 0 
push 0 
push thr 
push 0 
push 0 
call [CreateThread] 

.exit:
mov eax, 1
ret 12


thr: 
;jmp $ 
push 0
call @f
  db "Important message", 0
@@:
call @f
  db "People can understand things if them begin with simple things first instead of doing unnecesary raw coding", 0
@@:
push 0
call [MessageBoxA]
ret 4

section '.idata' import data readable 
dd 0,0,0,RVA kernel32_name,RVA kernel32_table 
dd 0,0,0,RVA user32_name,RVA user32_table 
dd 5 dup 0 
kernel32_table: 
CreateThread dd RVA _CreateThread 
Sleep dd RVA _Sleep 
dd 0 
user32_table: 
MessageBoxA dd RVA _MessageBoxA 
dd 0 
kernel32_name db 'kernel32.dll',0 
user32_name db 'user32.dll',0 
_MessageBoxA db 0,0,'MessageBoxA',0 
_Sleep db 0,0,'Sleep',0 
_CreateThread db 0,0,'CreateThread',0

section '.reloc' fixups data readable discardable

(Tested on OllyDbg and WORKS)
Post 25 Jan 2008, 16:46
View user's profile Send private message Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Jan 2008, 17:22
nope, createthread is caled, buy messagebox not. I use simple LoadLibrary to load it.
Post 25 Jan 2008, 17:22
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 25 Jan 2008, 17:42
Quote:

nope, createthread is caled,

Of course it is, but it will remain suspended till all DLLs acknowledge DLL_THREAD_ATTACH, something imposible with your push -1/call [Sleep] at DllMain.

Try the code I posted, it works.

[edit]And if still not convinced:
Code:
include 'win32axp.inc'

start:
  invoke LoadLibrary, "test2.dll"
  ret

.end start

test2.dll has the code of my post above and that shows the MessageBox.
Post 25 Jan 2008, 17:42
View user's profile Send private message Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Jan 2008, 18:08
it works now, thanks!!
Post 25 Jan 2008, 18:08
View user's profile Send private message Reply with quote
eskizo



Joined: 22 Nov 2005
Posts: 59
eskizo 17 Jun 2009, 21:10
Code:
push 0 
call @f 
  db "Important message", 0 
@@: 
call @f 
  db "People can understand things if them begin with simple things first instead of doing unnecesary raw coding", 0 
@@: 
push 0 
call [MessageBoxA]


OK.

push 0
call @f ;current address: "Important message" goes to stack
call @f ;current address: "People can..." goes to stack
push 0
call [MessageBoxA]

Nicelly done!
Post 17 Jun 2009, 21:10
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4624
Location: Argentina
LocoDelAssembly 17 Jun 2009, 21:53
Oh, seems I have written that code Razz

Note that it is nice but I have robbed the idea from Tomasz (invoke, cinvoke, ccall and stdcall macros do that trick when the parameter is a literal string provided you have included win32{a|w}x*.inc).
Post 17 Jun 2009, 21:53
View user's profile Send private message Reply with quote
asmcoder



Joined: 02 Jun 2008
Posts: 784
asmcoder 17 Jun 2009, 21:53
[content deleted]


Last edited by asmcoder on 14 Aug 2009, 14:51; edited 1 time in total
Post 17 Jun 2009, 21:53
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania
Borsuc 17 Jun 2009, 22:38
asmcoder wrote:
why you bump such idiotic and old thread?
why do you like to troll?

_________________
Previously known as The_Grey_Beast
Post 17 Jun 2009, 22:38
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Main index Download Documentation Examples Message board

Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.