Last active
August 29, 2015 14:27
-
-
Save BeRo1985/0104970a76af7a66a747 to your computer and use it in GitHub Desktop.
ASM dot vs. non-dot per directive
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
;====================================================================== | |
; With dot per directive | |
;====================================================================== | |
.macro CopyData(Src, Dest, Count, UseRep){ | |
.local Temp | |
cld | |
mov esi, Src | |
mov edi, Dest | |
.if(UseRep){ | |
mov ecx, Count | |
push ecx | |
shr ecx, 2 | |
rep movsd | |
pop ecx | |
and ecx, 3 | |
rep movsb | |
}else{ | |
Temp = __integer__(Count) | |
.while(Temp > 0){ | |
.if(Temp > 3){ | |
movsd | |
Temp = Temp - 4 | |
}else{ | |
movsb | |
Temp = Temp - 1 | |
} | |
} | |
} | |
} | |
CopyData [Source], [Dest], 0x1000, 0 | |
CopyData [Source], [Dest], 1000h, 1 | |
.library "kernel32.dll" | |
.import ExitProcess,"ExitProcess" | |
;====================================================================== | |
; Without dot per directive | |
;====================================================================== | |
macro CopyData(Src, Dest, Count, UseRep){ | |
local Temp | |
cld | |
mov esi, Src | |
mov edi, Dest | |
if(UseRep){ | |
mov ecx, Count | |
push ecx | |
shr ecx, 2 | |
rep movsd | |
pop ecx | |
and ecx, 3 | |
rep movsb | |
}else{ | |
Temp = __integer__(Count) | |
while(Temp > 0){ | |
if(Temp > 3){ | |
movsd | |
Temp = Temp - 4 | |
}else{ | |
movsb | |
Temp = Temp - 1 | |
} | |
} | |
} | |
} | |
CopyData [Source], [Dest], 0x1000, 0 | |
CopyData [Source], [Dest], 1000h, 1 | |
library "kernel32.dll" | |
import ExitProcess,"ExitProcess" | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
;====================================================================== | |
; With dot per directive | |
;====================================================================== | |
.target pe32 (imagebase = 0x400000, codebase = 0x1000, subsystem = gui, executable) | |
.cpu all | |
.bits 32 | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
; Zweite Makroassembler-Syntax Ebene mit JavaScript ; | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
.javascript { | |
Macro.invoke = function(){ | |
// 32-bit x86 stdcall invoke | |
var functionName = arguments[0]; | |
for(var i = arguments.length - 1; i > 1; i--){ | |
var functionParameter = arguments[i]; | |
Assembler.parse("push "+functionParameter); | |
} | |
Assembler.parse("call dword ptr ["+functionName+"]"); | |
} | |
Functions.replaceEAXwithEBX = function(asm){ | |
Assembler.parse(asm.replace("eax","ebx")); | |
} | |
} | |
.javascript.replaceEAXwithEBX { | |
xor eax,eax | |
add eax,123 | |
push eax | |
pop eax | |
} | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
; Erste Makroassembler-Syntax Ebene a la MASM/FASM/TASM ; | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
invoke MessageBox,byte 0,dword Text,dword Title,byte 0 | |
invoke ExitProcess,byte 0 | |
Title: db "Title" | |
Text: db "Hello world!" | |
.library "kernel32.dll" | |
.import ExitProcess "ExitProcess" | |
.import GetModuleHandle "GetModuleHandleA" | |
.library "user32.dll" | |
.import MessageBox "MessageBoxA" | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
a = "Hallo " | |
c = "grosse " | |
b = "liebe " + c | |
db a + b + "Erde\r\n", 0 | |
pi = 3.14159 | |
dd pi * 2.0 ; <= 6.26318 | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
e = 4 | |
lea eax,[(eax-eax)+(eax*1)+ebx*e] ; <= mov eax,[eax+ebx*4] | |
Dest equ eax | |
mov Dest,dword [Dest] ; <= mov eax,dword [eax] | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
a = 123 | |
.if(a == 123){ | |
invoke MessageBox,byte 0,dword Text,dword Title,byte 0 | |
invoke ExitProcess,byte 0 | |
}else if(a == "EinString"){ | |
.while(a > 0){ | |
db a | |
a = a - 1 | |
} | |
}else if(pi == 3.14159){ | |
times 1337 db 0x1337c0d3 | |
}else{ | |
db 1337 dup (0x1337c0d3) | |
} | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
.macro GDT(gdtLimit,gdtBase_00_15,gdtBase_16_23,gdtType,gdtMisc,gdtBase_24_31){ | |
dw gdtLimit | |
dw gdtBase_00_15 | |
db gdtBase_16_23 | |
db gdtType | |
db gdtMisc | |
db gdtBase_24_31 | |
} | |
.align 4 | |
GDTRTable: | |
dw (offset GDTRTableEnd)-((offset GDTRTable)+1) | |
GDTRBase: dw offset GDTRTable,0 | |
dw 0 | |
GDTR_CODE16: GDT 0xFFFF,0,0,0x9B,0x00,0 | |
GDTR_DATA16: GDT 0xFFFF,0,0,0x93,0x00,0 | |
GDTR_CODE32_Ring0: GDT 0xFFFF,0,0,0x9B,0xCF,0 | |
GDTR_DATA32_Ring0: GDT 0xFFFF,0,0,0x93,0xCF,0 | |
GDTR_CODE32_Ring3: GDT 0xFFFF,0,0,0xFB,0xCF,0 | |
GDTR_DATA32_Ring3: GDT 0xFFFF,0,0,0xF3,0xCF,0 | |
GDTR_TSS: GDT 0xFFFF,0,0,0x89,0x00,0 | |
GDTR_TIB: GDT 0xFFFF,0,0,0x93,0xCF,0 | |
GDTRTableEnd: | |
;times 32-2 dd 0x90909090 | |
IDTTable: times 2 dd 0x90909090 | |
IDT16Table: | |
dw 0x3ff | |
dd 0 | |
dd 0 | |
BootDrive: db 0 | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
PEEXEMAGIC=0x00004550 | |
PECPU386=0x14C | |
PECPU486=0x14D | |
PECPU586=0x14E | |
.struct TPEEXEHeader { | |
Signature dword(1) | |
CPUType word(1) | |
ObjectCount word(1) | |
TimeStamp dword(3) | |
NTHeaderSize word(1) | |
Flags word(1) | |
OptionalStart dword(4) | |
EntryPointRVA dword(1) | |
Reserved dword(2) | |
ImageBase dword(1) | |
ObjectAlign dword(1) | |
FileAlign dword(1) | |
VersionInfo word(8) | |
ImageSize dword(1) | |
HeaderSize dword(1) | |
CheckSum dword(1) | |
SubSys word(1) | |
DLLFlags word(1) | |
StackReserve dword(1) | |
StackCommit dword(1) | |
HeapReserve dword(1) | |
HeapCommit dword(1) | |
Fill dword(1) | |
RVAs dword(1) | |
ExportRVA dword(1) | |
ExportSize dword(1) | |
ImportRVA dword(1) | |
ImportSize dword(1) | |
ResourceRVA dword(1) | |
ResourceSize dword(1) | |
ExceptionRVA dword(1) | |
ExceptionSize dword(1) | |
SecurityRVA dword(1) | |
SecuritySize dword(1) | |
RelocationRVA dword(1) | |
RelocationSize dword(1) | |
DebugRVA dword(1) | |
DebugSize dword(1) | |
ImageDescRVA dword(1) | |
ImageDescSize dword(1) | |
MachineRVA dword(1) | |
MachineSize dword(1) | |
TLSRVA dword(1) | |
TLSSize dword(1) | |
} | |
.struct TPEEXESectionHeader { | |
Name byte(8) | |
VirtualSize dword(1) | |
RVA dword(1) | |
PhysicalSize dword(1) | |
PhysicalOfs dword(1) | |
Reserved dword(3) | |
Flags dword(1) | |
} | |
.struct TPEEXERelocation { | |
PageRVA dword(1) | |
BlockSize dword(1) | |
} | |
.smartlink LoadPEEXE { | |
push ebx | |
push ecx | |
push esi | |
; eax = pe header | |
; esi/ebx = mzexe header | |
mov esi,ebx | |
mov eax,ebx | |
add eax,dword [eax+0x3c] | |
; clear memory | |
push eax | |
push edi | |
mov ecx,dword ptr [eax+TPEEXEHeader.ImageSize] | |
xor eax,eax | |
push ecx | |
shr ecx,2 | |
rep stosd | |
pop ecx | |
and ecx,0x3 | |
rep stosb | |
pop edi | |
pop eax | |
; copy pe image heeder | |
push esi | |
push edi | |
mov ecx,dword ptr [eax+TPEEXEHeader.HeaderSize] | |
push ecx | |
shr ecx,2 | |
rep movsd | |
pop ecx | |
and ecx,0x3 | |
rep movsb | |
pop edi | |
pop esi | |
movzx ecx,word ptr [eax+TPEEXEHeader.ObjectCount] | |
movzx ebx,word ptr [eax+TPEEXEHeader.NTHeaderSize] | |
lea ebx,[ebx+eax+TPEEXEHeader.OptionalStart] | |
; copy sections | |
LoadPEEXECopySectionLoop: | |
push ecx | |
push esi | |
push edi | |
add esi,dword ptr [ebx+TPEEXESectionHeader.PhysicalOfs] | |
add edi,dword ptr [ebx+TPEEXESectionHeader.RVA] | |
mov ecx,dword ptr [ebx+TPEEXESectionHeader.PhysicalSize] | |
push ecx | |
shr ecx,2 | |
rep movsd | |
pop ecx | |
and ecx,0x3 | |
rep movsb | |
pop edi | |
pop esi | |
pop ecx | |
add ebx,TPEEXESectionHeader | |
dec ecx | |
jnz short LoadPEEXECopySectionLoop | |
mov eax,dword ptr [eax+TPEEXEHeader.EntryPointRVA] | |
pop esi | |
pop ecx | |
pop ebx | |
push ebx | |
mov ebx,edi | |
call loadPERelocate | |
add eax,ebx | |
pop ebx | |
ret | |
;--- subroutine | |
loadPERelocate: | |
pushad | |
mov edi,ebx | |
add edi,dword [edi+0x3c] | |
mov edx,ebx | |
sub edx,dword ptr [edi+TPEEXEHeader.ImageBase] | |
mov dword ptr [edi+TPEEXEHeader.ImageBase],ebx | |
mov esi,dword ptr [edi+TPEEXEHeader.RelocationRVA] | |
test esi,esi | |
jz short LoadPERelocateDone | |
mov ecx,dword ptr [edi+TPEEXEHeader.RelocationSize] | |
jecxz LoadPERelocateDone | |
LoadPERelocateMore: | |
mov ebp,dword ptr [ebx+esi+TPEEXERelocation.PageRVA] | |
mov ecx,dword ptr [ebx+esi+TPEEXERelocation.BlockSize] | |
jecxz LoadPERelocateDone | |
sub ecx,TPEEXERelocation | |
add esi,TPEEXERelocation | |
LoadPERelocateNext: | |
movzx eax,word ptr [ebx+esi] | |
mov edi,eax | |
and edi,0xfff | |
add edi,ebp | |
shr eax,12 | |
dec eax | |
jz short LoadPERelocateHigh | |
dec eax | |
jz short LoadPERelocateLow | |
dec eax | |
jz short LoadPERelocateHighLow | |
dec eax | |
jz short LoadPERelocateHighAdj | |
jmp short LoadPERelocateSkip | |
LoadPERelocateHigh: | |
push edx | |
shr edx,16 | |
add word ptr [ebx+edi],dx | |
pop edx | |
jmp short LoadPERelocateSkip | |
LoadPERelocateLow: | |
add word ptr [ebx+edi],dx | |
jmp short LoadPERelocateSkip | |
LoadPERelocateHighLow: | |
add dword ptr [ebx+edi],edx | |
jmp short LoadPERelocateSkip | |
LoadPERelocateHighAdj: | |
add esi,2 | |
sub ecx,2 | |
mov eax,dword ptr [ebx+edi-2] ; lo hi (little endian) | |
; or to be absolute safe: | |
; mov ax,word ptr [ebx+edi] | |
; shl eax,16 | |
mov ax,word ptr [ebx+esi] | |
lea eax,[eax+edx+0x8000] | |
shr eax,16 | |
mov word ptr [ebx+edi],dx | |
LoadPERelocateSkip: | |
add esi,2 | |
sub ecx,2 | |
jnz short LoadPERelocateNext | |
jmp short LoadPERelocateMore | |
LoadPERelocateDone: | |
clc | |
popad | |
ret | |
} | |
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; | |
.target mz (stack = 0x8000, heap = 0x0, startoffset = 0x100, entrypoint = StartLabel) | |
.cpu 386 | |
.segment CodeSegment use16 | |
StartLabel: | |
mov ax,seg16 DataSegment | |
mov ds,ax | |
mov byte ptr ds:[ofs16 TestData],al | |
call seg16 DummyFunc:ofs16 DummyFunc ; the preferred and correct way | |
call seg16 LibrarySegment:ofs16 DummyFunc ; also a correct way, but not the preferred way, because of possible mistake cases | |
call (LibrarySegment >> 4):ofs16 DummyFunc ; the wrong way, because no MZEXE relocation entries will be generated in this case | |
call (LibrarySegment >> 4):(DummyFunc-LibrarySegment) ; again, the wrong way, because no MZEXE relocation entries will be generated in this case | |
call seg16 ExitToDOS:ofs16 ExitToDOS | |
.segment LibrarySegment use16 | |
DummyFunc: | |
retf | |
ExitToDOS: | |
mov ah,0x4c | |
int 21h | |
.segment DataSegment | |
TestData: db 1,2,3 | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment