News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

Calc DLL Symble Hash comming Incorrect??

Started by AgentSmithers, June 24, 2009, 09:21:13 PM

Previous topic - Next topic

AgentSmithers

include \masm32\include\masm32rt.inc
includelib \masm32\lib\masm32rt.lib

.486
.model flat, stdcall
option casemap :none
.const
LL db "LoadLibraryA", 0
.code
start:

xor edi, edi
xor eax, eax
cld ;Clear Direction Flags For LoadStringByte

mov esi, OFFSET LL

push esi

compute_hash_again:
lodsb
test al, al
jz compute_hash_finished
ror edi, 0dh
add edi, eax
jmp compute_hash_again
compute_hash_finished:

pop esi

print hex$([esi])

;ret

;DEFINE CONSTANTS
   
;locate_kernel32_hashes:
;    call locate_kernel32_hashes_return

    ;LoadLibraryA
    ;db 0x8e
    ;db 0x4e
    ;db 0x0e
    ;db 0xec


I created this code to see if I can calculate DLL hashes the same way PE headers do and My results came wrong, The "Correct" Results for LoadLibraryA were supposed be

    ;db 0x8e
    ;db 0x4e
    ;db 0x0e
    ;db 0xec

I get
0x64616F4C

AgentSmithers

It seems like this is the Agro for Computing a Hash, and I cant see how this relates to my ASM Snippet... =(

int idx;
for(idx=0;;idx++){
unsigned int h;
unsigned char *c=sym[idx];
while(*c) h=((h<<5)|(h>>27))+*c++;
if(h==hash) break;
}


I wrote this in VC++6.0
// CalcDLLHash.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <stdio.h>
#include <string.h>
#include <iostream.h>
#include <mbstring.h>
char * CalcHash(unsigned char * MyString)
{
unsigned int h;
unsigned char *c=MyString;
while(*c) h=((h<<5)|(h>>27))+*c++;
printf("Done");
return 0;
}

int main(int argc, char* argv[])
{
//unsigned char* MyStr = new unsigned char [16];
//*_mbscpy(MyStr, unsigned char *("LoadLibraryA"));
unsigned char* MyStr = (unsigned char *)"LoadLibraryA";
//MyStr = MyStringA;
CalcHash(MyStr);
printf("Hello World!\n");
return 0;
}/
and the results came back
h = 0xFFE7AAA8 =(

BogdanOntanu

Please explain me: What is the purpose of this "hash" ?

Thread locked.

Ambition is a lame excuse for the ones not brave enough to be lazy.
http://www.oby.ro