Casting in assembly?

Okay... I seriously need to know how to cast in assembly, if there even is such a thing.

I've been using assume and found out that it's causing a problem for me. My program won't finish executing. When I use olly to debug, it gives me an exception error telling me I can't read at memory address 0000000.

When I remove the "assume" part of the code it works fine, everything executes properly. Halp!

Code:

Code:

.code

start:

	push 0
	push TH32CS_SNAPPROCESS
	call CreateToolhelp32Snapshot
	
 	mov processHandle,eax
	
	push ebx
	push processHandle
	call Process32First
	
Check_Loop:
	
	assume ebx: ptr PROCESSENTRY32
	lea edx,[ebx].szExeFile
	
	push offset TargetProcess
	push edx
	call lstrcmpi
	cmp eax,0
	je Found
	
	push ebx
	push processHandle
	call Process32Next
	jmp Check_Loop
Found:

	push 0
	call ExitProcess	
	
end start

It compiles fine.

I'm assuming the problem is the assume instruction, so I'd like to know if there are any other ways of 'casting' in assembly.

By the way, that part of the code executes fine. It's at the end of the program that it fails, try it out for yourself.

This has been bugging me for a while and I'd really appreciate if someone could possibly fix this for me.

Thanks.

Just looking at it here my guess would be the usage of ebx (Pushed as a parameter etc) while it requires a pointer. Obviously ebx = null so when it tries to fill that memory location with the PE32 data it fails.

You may want to try something like:

Code:

LOCAL pe32:PROCESSENTRY32  //put this on top of your function somewhere

//then where you call it
lea ebx,pe32
push ebx
push processHandle
call Process32First

using edi instead of ebx may visually make more sense...

How do you create an instance of a structure if you're not inside a user defined function? I'm not sure how to use LOCAL yet.

Edit: Nevermind I got it.. sort of, I didn't do it the way you said though, well kind of..

Code:

lpEntry PROCESSENTRY32 {}

.code

start:

	push 0
	push TH32CS_SNAPPROCESS
	call CreateToolhelp32Snapshot
	
 	mov processHandle,eax
	
	lea ebx,lpEntry
	
	push ebx
	push processHandle
	call Process32First
	
Check_Loop:
	
	mov ecx,offset lpEntry
	mov [ecx],ebx
	lea edx,[lpEntry].szExeFile
	
	push offset TargetProcess
	push edx
	call lstrcmpi
	cmp eax,0
	je Found
	
	push ebx
	push processHandle
	call Process32Next
	jmp Check_Loop
Found:

	push 0
	call ExitProcess	
	
end start

This part looks very inefficient and I'm sure there's another way to get across this.

Code:

mov ecx,offset lpEntry
mov [ecx],ebx
lea edx,[lpEntry].szExeFile

Yeah, it works though.... finally..

I would just create a function or alternatively you could try adding a global var to your data segment:

In your .Data add:
pe32 PROCESSENTRY32 <sizeof PROCESSENTRY32>

or alternatively in your .Data? add
pe32 PROCESSENTRY32 <?>
and then manually set the size:
mov [pe32.dwSize], size PROCESSENTRY32

In either way you'd end up dealing with pe32 e.g. "offset pe32.szExeFile" etc

Well, I've finally got my injector working, after a few hours of not noticing I was pushing too many parameters for a certain function..

Thanks BA!

Casting in assembly?

Post a Reply

Similar Threads

Tags for this Thread