Dark Bit Factory & Gravity

PROGRAMMING => Other languages => ASM => Topic started by: rain_storm on March 28, 2009

Title: Import by hash in Fasm
Post by: rain_storm on March 28, 2009

Here a little something that I've been tipping away at for awhile now. Its 1kb opengl in fasm and I used import by hash to sidestep the import section, should work on all NT systems (Im using the PEB meathod for obtaining the base address of kernel32) http://www.scribd.com/doc/2199087/Understanding-Windows-Shellcode . There is also a crinkler version that is compressed for comparison.

edit fixed code was missing ExitProcess,0 (using ret)

Code: [Select]

format MS COFF

 include 'win32a.inc'
 include 'equates\opengl32.inc'

 ;
 ;kernel32.lib
 ;
 extrn '__imp__ExitProcess@4'       as ExitProcess:dword
 ;
 ;user32.lib
 ;
 extrn '__imp__ShowCursor@4'        as ShowCursor:dword
 extrn '__imp__CreateWindowExA@48'  as CreateWindowExA:dword
 extrn '__imp__GetDC@4'             as GetDC:dword
 extrn '__imp__GetAsyncKeyState@4'  as GetAsyncKeyState:dword
 ;
 ;gdi32.lib
 ;
 extrn '__imp__ChoosePixelFormat@8' as ChoosePixelFormat:dword
 extrn '__imp__SetPixelFormat@12'   as SetPixelFormat:dword
 extrn '__imp__SwapBuffers@4'       as SwapBuffers:dword
 ;
 ;opengl32.lib
 ;
 extrn '__imp__wglCreateContext@4'  as wglCreateContext:dword
 extrn '__imp__wglMakeCurrent@8'    as wglMakeCurrent:dword
 extrn '__imp__glEnable@4'          as glEnable:dword
 extrn '__imp__glDepthFunc@4'       as glDepthFunc:dword
 extrn '__imp__glHint@8'            as glHint:dword
 extrn '__imp__glClear@4'           as glClear:dword
 extrn '__imp__glRotatef@16'        as glRotatef:dword
 extrn '__imp__glBegin@4'           as glBegin:dword
 extrn '__imp__glColor3f@12'        as glColor3f:dword
 extrn '__imp__glVertex3f@12'       as glVertex3f:dword
 extrn '__imp__glEnd@0'             as glEnd:dword

 public init
 init: xor     ebx, ebx
       invoke  ShowCursor, ebx
       invoke  CreateWindowExA, WS_EX_TOPMOST, szEdit, ebx, WS_POPUP+WS_VISIBLE+WS_MAXIMIZE, ebx, ebx, ebx, ebx, ebx, ebx, ebx, ebx
       invoke  GetDC, eax
       xchg    eax, ebp
       invoke  ChoosePixelFormat, ebp, pfd
       invoke  SetPixelFormat, ebp, eax, pfd
       invoke  wglCreateContext, ebp
       invoke  wglMakeCurrent, ebp, eax
       invoke  glEnable, GL_DEPTH_TEST
       invoke  glDepthFunc, GL_LEQUAL
       invoke  glHint, GL_PERSPECTIVE_CORRECTION_HINT, GL_NICEST

 main: mov     ebx, 0.6
       invoke  glClear, GL_COLOR_BUFFER_BIT+GL_DEPTH_BUFFER_BIT
       invoke  glRotatef, ebx, ebx, ebx, ebx
       invoke  glBegin, GL_QUADS
       xor     ecx, ecx
       mov     esi, cube
       mov     cl, 0x18

 face: push    ecx
       xor     eax, eax
       lodsb
       mov     cl, 0x06

 vert: push    ebx
       mov     edx, eax
       shr     eax, 1
       and     dl, 0x01
       ror     edx, 1
       xor     [esp], edx
       loop    vert
       call    [glColor3f]
       call    [glVertex3f]
       pop     ecx
       loop    face
       invoke  glEnd
       invoke  SwapBuffers, ebp
       invoke  GetAsyncKeyState, VK_ESCAPE
       test    eax, eax
       jz      main
       invoke  ExitProcess, NULL
       ret

 szEdit db 'edit', 0
 cube:  ;  bgrzyx   bgrzyx   bgrzyx   bgrzyx
 face1  db 100111b, 110110b, 110100b, 100101b
 face2  db 110100b, 110110b, 011010b, 111000b
 face3  db 100101b, 110100b, 111000b, 001001b
 face4  db 001011b, 011010b, 111000b, 001001b
 face5  db 100101b, 100111b, 001011b, 001001b
 face6  db 100111b, 110110b, 011010b, 001011b
 pfd    PIXELFORMATDESCRIPTOR sizeof.PIXELFORMATDESCRIPTOR, 1,

PFD_SUPPORT_OPENGL+PFD_DOUBLEBUFFER+PFD_DRAW_TO_WINDOW,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?

Edit - Reattached file

Title: Re: Import by hash in Fasm
Post by: Rbz on March 29, 2009

Nice work mate, works fine here.

Title: Re: Import by hash in Fasm
Post by: Jim on March 30, 2009

The crinkled cube.exe works here, but the 1k.exe crashes.  OS is Vista, gfx is nVidia.

Karma for posting code!

Jim

Title: Re: Import by hash in Fasm
Post by: rain_storm on March 30, 2009

darn it at least the crinkled one works looks like there is alot more to importing by hash than I thought
Oh well

Title: Re: Import by hash in Fasm
Post by: Jim on March 30, 2009

Oh, I see, the cubie doesn't use the new framework.  I'll see if I can find out anything else for you.
Btw, I notice the cubie has a line
       ;invoke  ExitProcess, NULL
Unfortunately you absolutely need that on Vista else the program will not exit cleanly.

Jim

Title: Re: Import by hash in Fasm
Post by: rain_storm on April 02, 2009

thanks for mentioning that you pick up a whole lotta bad habits when size codin

Title: Re: Import by hash in Fasm
Post by: Shockwave on May 14, 2009

I got the same thing here as Jim on XP, crinkled one works great, regular one crashes on start-up (sorry for my late reply).