[help] convert FASM syntax to MASM code

[herman2k]

Hello Community,
i hope this is here the right place.
Ok i have a Flat Assembler (FASM) code syntax but i need it convert to MASM syntax (I don´t have knowledge about MASM).
This code is dynamic loading DLL at runtime. When i using my FASM i can compiled it to a binary (*.bin) and afterwards i can copy/include the binary with a hex-editor to an executable. But before i need the MASM syntax, then i can using a tool called snipped creator

Code Select Expand


IMAGE_BASE = 0x04000000
                     
_LoadLibrary = 0x5929C + IMAGE_BASE
_GetProcAddress = 0x592E4 + IMAGE_BASE
_CopyFileA = 0x5936C


IMPORT_ENTRY_NAME_PANDA = 0x5B308
IMPORT_ENTRY_PANDA_FIRST_THUNK = 0x5977C
BACK_TO_EP = 0x55700 + IMAGE_BASE

use32

mov ebx,IMAGE_BASE

mov edx,IMPORT_ENTRY_NAME_PANDA
add edx,ebx

push edx
call dword [_LoadLibrary]

mov edx,IMPORT_ENTRY_PANDA_FIRST_THUNK
mov edi,IMPORT_ENTRY_PANDA_FIRST_THUNK

add edx,ebx
add edi,ebx

.load_api_addresses:

cmp dword [edx],0
jz .finished_api_loading

mov ecx,[edx]

inc ecx
inc ecx

add ecx,ebx

push edx
push eax

push ecx
push eax
call dword [_GetProcAddress]

stosd

pop eax
pop edx

add edx,4
jmp .load_api_addresses

.finished_api_loading:

push BACK_TO_EP
ret

here the same code in Ollydbg

Code Select Expand


004556E6 > $ BB 00004000    MOV EBX,patch.00400000                   ;  ASCII "MZP"
004556EB   . BA 08B30500    MOV EDX,5B308
004556F0   . 01DA           ADD EDX,EBX
004556F2   . 52             PUSH EDX                                 ; /FileName => "wsock32.dll"
004556F3   . FF15 9C924500  CALL NEAR DWORD PTR DS:[<&kernel32.LoadL>; \LoadLibraryA
004556F9   . BA 7C970500    MOV EDX,5977C
004556FE   . BF 7C970500    MOV EDI,5977C
00455703   . 01DA           ADD EDX,EBX
00455705   . 01DF           ADD EDI,EBX
00455707   > 833A 00        CMP DWORD PTR DS:[EDX],0
0045570A   . 74 18          JE SHORT patch.00455724
0045570C   . 8B0A           MOV ECX,DWORD PTR DS:[EDX]
0045570E   . 41             INC ECX
0045570F   . 41             INC ECX
00455710   . 01D9           ADD ECX,EBX
00455712   . 52             PUSH EDX
00455713   . 50             PUSH EAX
00455714   . 51             PUSH ECX                                 ; /ProcNameOrOrdinal
00455715   . 50             PUSH EAX                                 ; |hModule
00455716   . FF15 E4924500  CALL NEAR DWORD PTR DS:[<&kernel32.GetPr>; \GetProcAddress
0045571C   . AB             STOS DWORD PTR ES:[EDI]
0045571D   . 58             POP EAX
0045571E   . 5A             POP EDX
0045571F   . 83C2 04        ADD EDX,4
00455722   .^EB E3          JMP SHORT patch.00455707
00455724   > 55             PUSH EBP
00455725   . 8BEC           MOV EBP,ESP
00455727   . 83C4 F4        ADD ESP,-0C
0045572A   . 53             PUSH EBX
0045572B   . B8 D8544500    MOV EAX,patch.004554D8
00455730   . 68 84564500    PUSH patch.00455684
00455735   . C3             RETN                                     ;  RET used as a jump to 00455684


regards,
herman2k

[BogdanOntanu]

This looks to me like using a delta trick/offset and a load DLL by hand all this is specific to Vx, RtPackand injection...

Questions:

The "snippet creator" I know of is not very honorable... besides AFAIK FASM is capable to output PE diirectly...so why compile to a .BIN file?

What exactly do you want to do?

Is this your code?

What does this have to do with compiler technology?

BTW... read The Rules :D
We do not allow some kind of requests into this forums

[hutch--]

Yes,

The tool was originally used to add sections to a PE file that is an existing binary file and the rules of the forum specifically prohibit this type of code or posting.

This topic is closed.