BanMe
December 23rd, 2010, 13:02
Code:
SVC_HEAP_INIT equ 0
SVC_HEAP_WRITE equ 1
SVC_HEAP_READ equ 2
SVC_HEAP_CLOSE equ 3
HEAP_INIT struct
ServerHeapBase PVOID ?
ServerHeapPart PVOID ?
ServerHeapIndex DWORD ?
HEAP_INIT ends
HEAP_READ struct
HeapOffset DWORD ?
Data DWORD ?
HEAP_READ ends
HEAP_DATA struct
Init HEAP_INIT <>
Read HEAP_READ <>
HEAP_DATA ends
PHEAP_DATA TYPEDEF PTR HEAP_DATA
NT_ERR macro
.if Eax
Int 3
.endif
endm
CHECK_RETURN macro
.if !Eax
Int 3
.endif
endm
.code
comment -
HeapInit Initializes the Server Heap that I use to store data such as handles for later use.ecx = service,edx = PHEAP_DATA
HeapWrite uses 3 Parameters eax is the value to write,ecx = the service called, edx = PTR HEAP_DATA
HeapRead uses only ecx = Service,2 parameters in PHEAP_DATA HeapOffset, and a ptr to the area to read the data to..
HeapClose same params as heap Init.
-
HeapManager PROC FASTCALL ServiceWORD,Params:PHEAP_DATA
test ecx,ecx
jz HeapInit
dec ecx
jz HeapWrite
dec ecx
jz HeapRead
dec ecx
jz HeapClose
mov eax,0
jmp HeapReturn
HeapInit:
;assume edx:PSTACK_DATA
push edx
push eax
push eax
push 01024h
push eax
push eax
push HEAP_ZERO_MEMORY
call RtlCreateHeap
CHECK_RETURN
pop edx
mov HEAP_DATA.Init.ServerHeapBase[edx],eax
push edx
xor ecx,ecx
push 01024h
push ecx
push eax
call RtlAllocateHeap
CHECK_RETURN
pop edx
mov HEAP_DATA.Init.ServerHeapPart[edx],eax
xor ecx,ecx
mov HEAP_DATA.Init.ServerHeapIndex[edx],ecx
mov eax,ecx
jmp HeapReturn
HeapWrite:
mov ecx,HEAP_DATA.Init.ServerHeapPart[edx]
push edx
mov edx,HEAP_DATA.Init.ServerHeapIndex[edx]
mov [ecx + edx*4],eax
pop edx
inc HEAP_DATA.Init.ServerHeapIndex[edx]
xor ecx,ecx
mov eax,ecx
jmp HeapReturn
HeapRead:
mov ecx,HEAP_DATA.Read.Data[edx]
mov eax,HEAP_DATA.Init.ServerHeapPart[edx]
add eax,HEAP_DATA.Read.HeapOffset[edx]
mov eax,[eax]
mov [ecx],eax
xor ecx,ecx
mov eax,ecx
jmp HeapReturn
HeapClose:
push edx
push HEAP_DATA.Init.ServerHeapPart[edx]
push MEM_RELEASE
push HEAP_DATA.Init.ServerHeapBase[edx]
call RtlFreeHeap
push HEAP_DATA.Init.ServerHeapBase[edx]
call RtlDestroyHeap
xor ecx,ecx
mov eax,ecx
pop edx
HeapReturn:
ret
HeapManager endp
So I have this code and I've worked out most of the bugs for use in masm using Poasm to compile it fastcall and polink to compile the masm obj with the poasm obj..
I've been trying to think of ways to minimize Use of API, while still achieving a desirable result..To this effect can see the internal api's(RtlCreate and RtlAllocate) used in this function could be could be substituted by the stack, the base could be re/stored and passed back, and unsafe 'writes' with ambigious registers could be avoided.This could optimize it even further..some thoughts or opinions?
BanMe