Convenient import macros

Index > Macroinstructions > Convenient import macros

Goto page 1, 2 Next

Author

Thread

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

Code:

; Convenient and optimized import macros
; v1.02
; for flat assembler by Grom PE

; Features:
; - smallest possible import directory, especially when placed in the end of section.

; Adding imports:
; import kernel32.dll, lstrlenW, GlobalUnlock, GlobalLock, GlobalAlloc, GetCommandLineW
; import user32.dll, SetClipboardData, OpenClipboard, EmptyClipboard, CloseClipboard
; importend

; Don't forget the brackets, use:
; call [GetCommandLineW]

macro import_part1 library, [api]
{
  common
    library#_str: db `library
  forward
    if rva $ mod 2 = 0
      db 0
    end if
    ; When align is right, one byte from previous import name
    ; is used as byte for next import's hint.
    api#_str = $-1
    db 0, `api
  common
    db 0
}

import_part2_first = 0

macro import_part2 library, [api]
{
  common
    if import_part2_first = 0
      align 4
      import_part2_first = 1
    else
      dd 0
    end if
    library#_import:
  forward
    api dd rva api#_str
}

macro import_part3 [library]
{
  common
    data import
  forward
    dd 0, 0, 0, rva library#_str, rva library#_import
  common
    rd 5
    end data
}

import_list equ
import_libraries equ

macro import library,[api]
{
  common
    import_list equ import_list import_#library
    import_#library equ library,api
    import_libraries equ import_libraries,library
}
 
macro importend
{
  match a, import_list
  \{
    irps b, a \\{ match c, b \\\{ import_part1 c \\\} \\}
    irps b, a \\{ match c, b \\\{ import_part2 c \\\} \\}
  \}
  match =,a,import_libraries \{ import_part3 a \}
}

Last edited by Grom PE on 24 Jan 2009, 16:36; edited 2 times in total

21 Jun 2008, 17:57

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

Any help?

04 Jul 2008, 11:11

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 18828
Location: In your JS exploiting you and your system

revolution

I don't see how they are simpler, but never mind, to answer your Q at the end:

Code:

import_names equ null
macro import name,[stuff]{
 common
  import_part1 name,stuff
  import_part2 name,stuff
  import_names equ import_names,name
}

import blah1,blah1,...
import blah2,blah2,...

match x=,names{import_part3 names}

Untested, just simply put here on the fly, so maybe doesn't work, but hopefully the idea is clear.

Somehow I get the feeling that this is not what you want but it seems to be what you are asking for. Perhaps some clarification is needed?

04 Jul 2008, 11:28

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

revolution, thanks, but it's not what I want, and line

Code:

match x=,names{import_part3 names}

doesn't work at all.
Your import macro mixes part1 and part2, while I want them ordered.

In general, I want macros that gives the same result as second piece of code in first post, but with clearer syntax:
- call import_part1 for every DLL, with list of functions;
- call import_part2 for every DLL, with list of functions;
- call import_part3 with list of all DLLs

04 Jul 2008, 12:10

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 18828
Location: In your JS exploiting you and your system

revolution

Yeah, I expected it may not be what you wanted. But perhaps the macros I used for imports in my principles topic can give you some ideas.

BTW: a stupid omission in my code above, should be:

Code:

match x=,names,import_names{import_part3 names}

04 Jul 2008, 12:19

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

All right, I wrote it! =)
Add the following code to the first post:

Code:

import_list equ
import_libraries equ

macro import library,[api]
{
  common
    import_list equ import_list import_#library
    import_#library equ library,api
    import_libraries equ import_libraries,library
}
 
macro importend
{
  match a, import_list
  \{
    irps b, a \\{ match c, b \\\{ import_part1 c \\\} \\}
    irps b, a \\{ match c, b \\\{ import_part2 c \\\} \\}
  \}
  match =,a,import_libraries \{ import_part3 a \}
}

Now functions can be imported just with

Code:

import kernel32.dll, lstrlenW, GlobalUnlock, GlobalLock, GlobalAlloc, GetCommandLineW
import user32.dll, SetClipboardData, OpenClipboard, EmptyClipboard, CloseClipboard
importend

The last question would be: is it possible to get rid of 'importend'? =)

04 Jul 2008, 14:42

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 18828
Location: In your JS exploiting you and your system

revolution

Grom PE wrote:

All right, I wrote it! =)

good job

Grom PE wrote:

The last question would be: is it possible to get rid of 'importend'? =)

That would be great if you can figure it out, I've never yet found a way to excise any of those "end" style macros.

04 Jul 2008, 14:46

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

New version, first post updated.
Move this topic to Macroinstructions, please. Thanks.

Edit: or this should stay in Windows subforum? I'm confused.

24 Jan 2009, 13:51

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly

Moved.

Would you mind commenting what are the advantage of using your macros over the standard ones in the first post? What are the optimizations you are talking about?

I'm not saying that there is something wrong, just that your macros are lacking of a phrased explanation.

24 Jan 2009, 14:53

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

It generates the smallest possible import directory, especially when placed in the end of section.

The trick is, when align is right, one byte from previous import name is used as byte for next import's hint.

Oh, and there's a bug: it doesn't work with relocations, complains on line:

Code:

if $ mod 2=0

Any ideas what should I write there instead?
In other words, how to do relocation-friendly align check?

24 Jan 2009, 15:48

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 18828
Location: In your JS exploiting you and your system

revolution

Grom PE wrote:

In other words, how to do relocation-friendly align check?

Erm, maybe align?

[edit]
Oops, sorry you want a check, not a alignment. Ignore.

Last edited by revolution on 24 Jan 2009, 16:01; edited 1 time in total

24 Jan 2009, 15:58

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly

Maybe "if rva $ mod 2 = 0"?

Thanks for the explanation, put it in the first post later if you can (or want, it is just a suggestion after all, not a commandment Razz

)

24 Jan 2009, 15:58

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

LocoDelAssembly, thanks, it works!
First post updated.

24 Jan 2009, 16:36

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan

hmm, can it be compared to size of import by original fasm import macroses?
What's the difference? And what is "smallest"? Then what is opposite to smallest? Sample of unoptimal import by some macro/linker?

24 Jan 2009, 18:28

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE

asmfan, so many questions, but I'll answer to them =)

Quote:

can it be compared to size of import by original fasm import macroses?

Of course, just try on your favourite fasm program.

Quote:

What's the difference?

The difference is in executable size. Not much anything else, I think.

Quote:

And what is "smallest"?

It's having smallest increase in size of the resulting program.

Quote:

Then what is opposite to smallest?

I think you can derive the answer from the previous answer.

Quote:

Sample of unoptimal import by some macro/linker?

It's not clear. Do you want to see a macro/linker that makes bigger import? That's everything else, I think, as I didn't see my tricks used anywhere.

24 Jan 2009, 19:48

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr

asmfan wrote:

Then what is opposite to smallest?

That's easy, don't you have seen multiple import descriptors for the same DLL in PEs?

24 Jan 2009, 22:05

bitRAKE

Joined: 21 Jul 2003
Posts: 3464
Location: vpcmipstrm

bitRAKE

Of course, the DLL extension is not needed, but I didn't know about saving the other byte.

I like the following syntax which results from overloading the DATA and END keywords:

Code:

data import,\
  < kernel32, lstrlenW, GlobalUnlock, GlobalLock, GlobalAlloc, GetCommandLineW >,\
  < user32, SetClipboardData, OpenClipboard, EmptyClipboard, CloseClipboard >
end data

25 Jan 2009, 04:17

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan

Grom PE yes, my fault for not digging into code =)
In best way we have 1byte per import function due to hint/closing zero right? And once again you're right - unique trick.
baldr i don't use such linkers;) I guess i'ts either old Borland's products linkers or dumps of apps. Anyway it's darn bad written old (hope Borlad /if it exists)/ fixed this) HLL stuff.

Quote:

common
library#_str: db `library
forward
if rva $ mod 2 = 0
db 0
end if
; When align is right, one byte from previous import name
; is used as byte for next import's hint.
api#_str = $-1
db 0, `api

I believe hint won't be 0 in some cases, low byte will be equal to last char of prev string of library#_str.
If don't care about all hint zeroed then we get extra byte per each imported dll)

25 Jan 2009, 07:39

kempis

Joined: 12 Jun 2008
Posts: 49

kempis

How if we simply ignore alignment?
[code];;;;;;
api dd rva api#_str-2
;;;;;
api#_str db `api,0[code]

15 Feb 2009, 07:28

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan

Every entry must be aligned even 1st one as i said above. see pecoff_v8 for info.

15 Feb 2009, 09:33

Goto page 1, 2 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum