flat assembler
Message board for the users of flat assembler.

Index > Windows > driver in fasm

Author
Thread Post new topic Reply to topic
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 24 Apr 2008, 01:13
i need an example of .sys wich will just printf smth via DbgPrint, thx.
Post 24 Apr 2008, 01:13
View user's profile Send private message Reply with quote
AlexP



Joined: 14 Nov 2007
Posts: 561
Location: Out the window. Yes, that one.
AlexP 24 Apr 2008, 12:48
You might be able to find something on the FASM site. I believe there's a native in there.

All I know is 'format PE native' or something Confused
Post 24 Apr 2008, 12:48
View user's profile Send private message Visit poster's website Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Apr 2008, 01:59
thers only 'Win64 drivers example'. sorry, im not pro to understand it =/
i just need a simple DbgPrint example.
Post 25 Apr 2008, 01:59
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20362
Location: In your JS exploiting you and your system
revolution 25 Apr 2008, 02:11
Do you mean OutputDebugString?
Post 25 Apr 2008, 02:11
View user's profile Send private message Visit poster's website Reply with quote
asmrox



Joined: 19 Jan 2008
Posts: 160
asmrox 25 Apr 2008, 02:28
OutputDebugString = wrapper from kernel32...



http://msdn2.microsoft.com/en-us/library/aa363362(VS.85).aspx
Quote:
Remarks

If the application has no debugger, the system debugger displays the string if the filter mask allows it. (Note that this function calls the DbgPrint function to display the string. For details on how the filter mask controls what the system debugger displays, see the DbgPrint function in the Windows Driver Kit on MSDN.) If the application has no debugger and the system debugger is not active, OutputDebugString does nothing.
Post 25 Apr 2008, 02:28
View user's profile Send private message Reply with quote
Feryno



Joined: 23 Mar 2005
Posts: 509
Location: Czech republic, Slovak republic
Feryno 25 Apr 2008, 06:52
The FASM forum is really huge collection of amazing things, it's just hard to find them...
for 32 bit sample get the attachment from the last post at
http://board.flatassembler.net/topic.php?t=3434

Just note that you need to do hundreds instructions before your driver executes your code. Usual driver has procedures for loading driver, unloading driver and at least 1 procedure for 'communicating' with the driver (e.g. for reading from driver, writing into driver, DeviceIoControl etc).
The simplest driver may execute just dbgprint and end itself with the ret instruction. But in this case the driver isn't unloaded, so you can't run it more than once per win session, you need to reboot win or rename driver name etc.

The 32-bit sample posted there helped me a lot for developping 64-bit samples http://flatassembler.net/examples/win64_drivers.zip
(studying what to do - skeleton, disassembling real win64 drivers - the smalles I found - just about 2 kB of code, fixing something in import section and that was all)
Post 25 Apr 2008, 06:52
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.