Daily Dose of Assembly

**Toymaker** · 06-03-2009

In this thread I will administer a dose of assembly education each day. This is not a game hacking, or assembly programming, tutorial - it is however practical concepts you can apply...

DaY 1:

Introduction:

In the windows platform, there are modules naturally in active process i.e. kernel32.dll in which with out, your software could not exit properly (the API known as ExitProcess). Your CPU assigns a new memory space per request, on application load, but still allows accessibility to such functions.

You can not only call them in your programs, such as exit(0); in cplusplus or invoke exitprocess,0 in mASM but, you can at any point in time make use of them in your hacks, or debugging session.

Practical Uses:

Your own hot keys in your hacks
Your own exception/error handling
Defeating game's own limitations
Simulating Key Syncs

HowTo: Manipulate ExitProcess:

I have created a quick example program in cplusplus (as it looks the cleanest in disassembly) in where I use exit(0); (which calls Kernel32.ExitProcess). You'll notice in both programmatic examples i've given, there is one parameter to it, and it's 0. Any way, it looks like this:

Code:

004013C6  |. C70424 00000000         MOV DWORD PTR SS:[ESP],0                         ; |
004013CD  |. E8 8EF20000             CALL <JMP.&msvcrt.exit>                          ; exit

If you try using a CALL EXITPROCESS yourself, you'll notice the address that commonly represents that <JMP.&msvcrt.exit> is 7C81CDEA but may vary. Any way, it is basically all the same. You establish the one parameter and then call the ExitProcess function, in which it passes too. Therefore, you can add...

Code:

mov esp,0
call ExitProcess

...to your hacks and force a termination of execution. You could also try a CMP to detect last key pressed, etc. If you are interested in how to use the ESCAPE key as a hotkey, you can look up which parameter / value represents the ESC_Key and pass it to the GetKeySync function:

Code:

004013BA  |> C70424 1B000000         /MOV DWORD PTR SS:[ESP],1B                             ; |
004013C1  |. E8 0AF50000             |CALL <JMP.&USER32.GetKeyState>                        ; GetKeyState

Code:

mov esp,1b
call GetKeySync

...although it's actually in user32.dll, another example pre-process module. If you wonder why [ESP] is used, its because it handles the last information for going to and returning from a CALL. It's part of the stack / unique memory space I mentioned, in a sense. That concludes the daily dose of assembly for June 03 2009. Tomorrow will come another, but some one should reply so I don't have to double post and we can keep this thread alive, lawl.

**Toymaker** · 06-04-2009

DaY 2:

Introduction:

There are certain cases in which you do not have enough room in the actual function to make much modifcation. If you encounter: 40400D0 | EB08 you obviouslly don't room to change it to some 5 byte CALL to some function. In this Daily Dose of Assembly, i'll explain JMP vs CALL and show you how to use CAVES to avoid using larger amounts of in-Routine memory.

The first and foremost important concept is a JMP can vary in operand size, while a CALL can not. If you are making a LOCAL jump, and mind you that literally means local to the area, your jump will only consist of 2 bytes. ## ## the first two numbers will represent the type of JMP you're using...

Code:

EB = JMP
74 = JE
75 = JNE
E9 ## ## ## ## = If Far Jump

...and the second two the amount of bytes away the target offset is. In a CALL situation. It will take up five bytes of memory. E8 ## ## ## ## ## like a Far Jump. The four bytes of ## are basically the target address inversed and tagged.

The thing that's similar about CALL and JMP is they bump 'move' the current execution to the target address. They both are technically loading the new address into EPI but, only CALL loads the return address, into [ESP] and then subtracts ESP by 4.

Practical Uses:

Making greater modifications than space limitations allow
Keeping better track of information to balance

HowTo: Caves:

You can use a dissasembler or a debugger to find points of un used, extra assigned, memory that is not temporary. You can simply scroll down to the bottom, in this example with notepad I have

Code:

7C97DDE2   0000             ADD BYTE PTR DS:[EAX],AL
7C97DDE4   0000             ADD BYTE PTR DS:[EAX],AL
7C97DDE6   0000             ADD BYTE PTR DS:[EAX],AL

...for example. I can find some random point in memory and tamper with it to demostrate these ends, without
causing errors as so

I look at

Code:

7C9012A4   897A 04          MOV DWORD PTR DS:[EDX+4],EDI
7C9012A7   0BFF             OR EDI,EDI

There is not enough space to make a 5 byte long jump to our caves but it's okay because we can restore
memory at it. I'll write it

Code:

7C9012A4   E9 39CB0700      JMP ntdll.7C97DDE2
...
7C9012A9   74 22            JE SHORT ntdll.7C9012CD

I completely ruined the original first two offsets but i can handle it by writing

Code:

7C97DDE2   897A 04          MOV DWORD PTR DS:[EDX+4],EDI
7C97DDE5   09FF             OR EDI,EDI
7C97DDE7  ^E9 BD34F8FF      JMP ntdll.7C9012A9

...to my caves and now every thing is the same, and functions as so, but I added space
to active memory for my modifying. That concludes DaY 2

**InHuman** · 06-04-2009

toymaker i guess i am not getting in..huh?

**Toymaker** · 06-05-2009

I actually have developed this thread for myself as a hobby when i'm taking breaks between codes. I assume you are referring to being invited to one of two social groups for the new releases on the way. Truth be told, I was going to send you an invite when I sat down and decided who all else to add. I'll send it now, but don't hijack my threads with off topic pish posh any more.

DaY 3:

Introduction:

In this day of the Daily Dose of Assembly by Toymaker, we'll be discussing the fundamentals behind functions and even some obsufcation.

Notice: I use some c++ examples for the programs i'm 'reversing' in the lessons, beings it's most commonly seen and in a simple form.

Practiality:

Hide your coding from hackers
Better understand and use calls

HowTo: Pass Arguments | Obsfucate:

You will notice two primary types of functions called in assembly. One set, are in-application functions that were programmed by the user. They are usually called, without notifcation, as their pointer value.

Code:

call 4040D00

...may be a call to the 'check password' function after you enter a password. Or even to print a string assigned by the application. I'll compare two examples:

Code:

004013BA  |. C74424 04 00004400     MOV DWORD PTR SS:[ESP+4],Untitled.00440000        ;  ASCII "Enter Password
"
004013C2  |. C70424 C0334400        MOV DWORD PTR SS:[ESP],Untitled.004433C0

...versus...

Code:

004013E1  |. C70424 10004400        MOV DWORD PTR SS:[ESP],Untitled.00440010          ; |ASCII "pause"
004013E8  |. E8 93F20000            CALL <JMP.&msvcrt.system>                         ; system

...you see one function (004433C0) is the applications own printing function...while below it, <JMP.&msvcrt.system> is clearing making a call to your system. In C++ this would be:

Code:

system("pause");

...you notice how the assembly sets up "pause" as a parameter, in [ESP], to be passed, via calling, to the system()? In the above example it does the same BUT you notice it moves into both [ESP] and [ESP+4], it's because the "new line" function/command, \n in c++, also counts as a parameter.

In conclusion, i'll show you a basic example of assembly obsfucation. The normal c++ code for the above was:

Code:

cout<<"Enter Passwordn";
system("pause");

...so now what I will be doing is

Code:

#define say cout<<
char* urPrompt = "enter passwordn";
say urPrompt;

...this is the new form, better hidden, in disassembly

Code:

004013BF  |. 894424 04                  MOV DWORD PTR SS:[ESP+4],EAX
004013C3  |. C70424 C0334400            MOV DWORD PTR SS:[ESP],Untitled.004433C0
004013CA  |. E8 99AC0300                CALL Untitled.0043C068

...You notice there's no ;text hint telling you the message now? The pointer
is hidden behind a register, as well. You can use this simple method to hide your
code from reversers. ALTHOUGH AFTER the program executes once, the information will
still be loaded and findable for you at 4433C0.

**Jakor** · 06-05-2009

Day 1

Originally Posted by Toymaker

If you try using a CALL EXITPROCESS yourself, you'll notice the address that commonly represents that <JMP.&msvcrt.exit> is 7C81CDEA but may vary. Any way, it is basically all the same. You establish the one parameter and then call the ExitProcess function, in which it passes too. Therefore, you can add...

Code:

mov esp,0
call ExitProcess

I have to interject...
The address to Kernel32.ExitProcess will *NOT* jump around from windows version to windows version (kernel32 is always loaded in the same place in memory everytime for every process according to windows version). msvcrt's library wrapper function will move around. However the code section shows a call to Kernel32.ExitProcess not MSVCRT.exit. Also this would cause an error. mov esp, 0 sets the stack pointer to 00000000 not the data at esp to 0 correct code would look like this:

Code:

mov dword ptr [esp],0
call ExitProcess ;or JMP.&msvcrt.exit

Originally Posted by Toymaker

Code:

mov esp,1b
call GetKeySync

See code section above for same mistake... (should be mov dword ptr [esp],1b)

However, if you are writing code in assembly / debugger take note of the two lines below:

Code:

C70424 1B00000>MOV DWORD PTR SS:[ESP],1B   ;6bytes (1B or 00 doesn't matter)
6A 1B          PUSH 1B   ;2bytes (1B or 00 doesn't matter)

which one do you think is more efficient?

Also you need to take care of the stack. While I figured not taking care of it for exitprocess is ok as everything gets deallocated (still not good programming practices), putting a check for keystate in a game loop or watever will seriously screw with the stack.

Code:

function proc arg:DWORD
ret 4
function endp
start:
push 00
call function
mov dword ptr [esp], 0
call function
ret

walking through this from start:
push 00 (performs this: mov dword [esp],00000000, sub esp, 4)
call function (performs this: mov dword [esp], addr "mov dword ptr [esp], 0", sub esp, 4)
ret 4 (performs this: add esp 4 then (almost) pop eip)
mov dword ptr [esp], 0 (performs this: mov dword ptr [esp], 0)
call function (performs this: mov dword [esp], addr "ret", sub esp, 4)
ret 4 (performs this: add esp 4 then (almost) pop eip)
ret (would exit the process un-gracefully)

If you were to put this in an infinite loop you would see esp do this:
assuming esp == 00

@@:
push 00 ;esp == -4d
call function ;esp == -8d
ret 4 ;esp == 00
mov dword ptr [esp], 0 ;esp == 0
call function ;esp == -4d
ret 4 ;esp == 4d
jmp @B ;next time esp == 8d then 12d then 16d ect....
ret

I also have to add that since I am not a c programmer, I don't use cdecl calling convention much (wsprintf being the exception so far). While your disassembly shows the mov dword ptr [esp], that is because it won't have to clean up the stack after the call. Some c libraries work this way, most do not.

**Jakor** · 06-05-2009

DAY 2

Originally Posted by Toymaker

Code:

7C97DDE2   897A 04          MOV DWORD PTR DS:[EDX+4],EDI
7C97DDE5   09FF             OR EDI,EDI
7C97DDE7  ^E9 BD34F8FF      JMP ntdll.7C9012A9

While your example is decent, I would stress that making code caves in the application's module is imperative. I would not suggest making code caves especially in ntdll unless you really know what you are doing.

At some point you might want to explain dll's and how they save you from needing to use code caves.

**Toymaker** · 06-05-2009

I can only say 'you are correct' and, 'I know.' I just didn't care to get too detailed or directly correct, in my basic tutorial series. I will continue it, and you can always continue adding to it.

**radnomguywfq3** · 06-05-2009

Originally Posted by Jakor

DAY 2

While your example is decent, I would stress that making code caves in the application's module is imperative. I would not suggest making code caves especially in ntdll unless you really know what you are doing.

At some point you might want to explain dll's and how they save you from needing to use code caves.

While you are correct, there is tons of excess space in the PE Header, and as long as your careful not to overflow that memory region it's safe. Although, generally you can just load your own library into the target's address space containing the code you wish to execute opposed to writing a code-cave. Seeing as this is an assembly tutorial that would be irrelevant though. Even if you can only push a couple bytes in(chances of this are really low, as there is, like I said, tons of excess space) you can always call APIs to reallocate more memory.

**Jakor** · 06-06-2009

I will assume we are now talking using code caves to create permanent changes to an application (no need for a dll/loader makes it easy to use).