OHPen
August 16th, 2008, 06:39
Heyho,
actually i prepare a new unwrapping dll for my nucleus framework.
In this dll i want to use assembler:
code looks something like this:
I want to use the asm_get_entry_point_functino as declspec naked. And please don't mention that the asm_.... function does not return the entry_point right now, i know that
From the compiler and linking perspective everything works fine. No complains about syntax or similar stuff.
When the dll is loaded the first MessageBox is displayed and then the dll exits.
Instead it should execute the asm_... function.
Any idea whats the problem in this case ?
Regards,
OHPen
PS: Usually i prefere pure highlevel code or pure assembler. i never got used to inline assembler
actually i prepare a new unwrapping dll for my nucleus framework.
In this dll i want to use assembler:
code looks something like this:
Code:
/* system includes */
#include <windows.h>
/* nucleus includes */
#include <nucleus_dll.h>
BOOL
WINAPI
DllMain(HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpReserved)
{
/* local function variables */
DWORD entry_point = 0xDEADBEEF;
/* ----------------------------- */
switch( fdwReason )
{
case DLL_PROCESS_ATTACH:
MessageBox(NULL, "DLL_PROCESS_ATTACH -> nucleus_dll.dll", "Info", 0);
asm_get_entry_point(&entry_point);
MessageBox(NULL, "DLL_PROCESS_ATTACH -> nucleus_dll.dll", "Info", 0);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
__declspec (naked)
void
asm_get_entry_point(DWORD* entry_point)
{
__asm
{
mov esi, dword ptr fs:[0]
rkmh_checkNextEntryInSEHList:
lodsd
cmp eax, 0FFFFFFFFh
je rkmh_lastSEHEntryFound
mov esi, eax
jmp rkmh_checkNextEntryInSEHList
rkmh_lastSEHEntryFound:
mov edi, dword ptr[esi + 4]
and edi, 0FFFF0000h
rkmh_stepBackToFindKernel32MZHeader:
cmp word ptr[edi], 'ZM'
jz rkmh_MZHeaderFound
sub edi, 10000h
jmp rkmh_stepBackToFindKernel32MZHeader
rkmh_MZHeaderFound:
mov ebx, edi
add ebx, [ebx].e_lfanew
cmp word ptr[ebx],'EP'
je rkmh_Kernel32ModuleHandleFound
sub edi, 10000h
jmp rkmh_stepBackToFindKernel32MZHeader
rkmh_Kernel32ModuleHandleFound:
mov eax, edi
add eax, [eax].e_lfanew
add eax, 4
xor ebx, ebx
mov bx, word ptr [eax + 20]
cmp ebx, IMAGE_NT_OPTIONAL_HDR32_MAGIC
je rkmh_32bit
jmp rkmh_64bit
rkmh_32bit:
nop
int 3
jmp finished
rkmh_64bit:
nop
jmp finished
finished:
ret 4
}
}
I want to use the asm_get_entry_point_functino as declspec naked. And please don't mention that the asm_.... function does not return the entry_point right now, i know that

From the compiler and linking perspective everything works fine. No complains about syntax or similar stuff.
When the dll is loaded the first MessageBox is displayed and then the dll exits.
Instead it should execute the asm_... function.
Any idea whats the problem in this case ?
Regards,
OHPen
PS: Usually i prefere pure highlevel code or pure assembler. i never got used to inline assembler
