Hi, everybody.

I worked a program recently written and protected with aspack.
There are five sections called : aspack, aspack, .rsrc, pcompact, pcompact.

No file checker could tell me what version of aspack it is. I would like to know that. Do those names ring a bell ?

I unpacked it manually and arrived at the :
popad
jmp to Entry Point.

in Softice I did the usual :
a
jmp eip

then I dumped it with Lord PE and restore the IAT with Import Rec.
Dump worked as the packed program.

Strings References where very poor (only 3 !). I patched a few places to disable the anti-softice and nasty nagscreens.
----------------------

Then I tried another way :
instead of dumping and IAT rebuilding, I tried to patch the packed prog. After
popad
jmp to Entry Point there was about 200 free bytes.
On the "jmp to Entry Point" line I typed :
a
mov dword ptr [0044????], 90909090
mov word ptr [0044????], 9090
....
....
....
jmp to Entry Point
g

Program worked OK.

I saved the live patch with :
/dump 0047???? c0 patch.bin
and with HexWorkShop I patched the packed program. All worked OK.
-----------------------

Then I tried to assemble the patch with TASM or MASM. And now is the question :-)
When I type in Softice build-in assembler :
mov dword ptr [0044????], 90909090
Softice puts : c7 05 ?? ?? 44 00 90 90 90 90
that line writes an immediate value (90909090) into an immediate memory.
[0044????] doesn't mean "the value stocked into 0044???? memory". It means the memory itself.

When I assemble the same line with TASM or MASM they refuse ("illegal immediate". To have the same result I must write :
mov eax, 0044????
mov dword ptr [eax], 90909090
which is longer.

Why SoftIce assembler accepts to write directly 90 90 90 90 in dword memory 0044????, and the other assemblers don't ?

TIA
Artifex

Answer came from alt.lang.asm

Trying to compile this source with TASM :
MODEL Tiny
.data
.code
.386
org 100h
Start:
mov dword ptr [445120h], 90909090h
END start

throws an "illegal immediat" error

but TASM compiles OK this one :

MODEL Tiny
.data
.code
.386
org 100h
Start:
mov dword ptr [ds:445120h], 90909090h
END start

The debugger assembler doesn't need this ds: mention, he knows where data are.

Artifex

It's more of a assumption rather than "knowing". In RTA for example, any address like the one you specified is assumed to be referenced to DS unless you tell it otherwise. So it'll happily accept the way you typed it into SoftIce.

Hi, Squidge, and many thanks for the information. I begin to understand a little better the situation, and read more about "overriding".
Until know I knew enough asm for my needs, but this problem told me that I need to learn more.

Artifex

Hi, again, Squidge.

I tested RTA110.exe
It does exactly what I needed.
I didn't know that you were the author.

Congratulations.

Artifex