mov [zcode + 1], edx
gives an error "immediate operand not allowed"
and zcode is
zcode:
mov edi, 0ABCDEFAAh
anyway my question is considering i'm using all registers for code above how can I make that work? Since it won't let me use zcode, that works in tasm fine.
It's just an MASM syntax thing - zcode is a code label, and you're trying to put a dword (register) value into it. They don't match - it complains. So just force it to match :bg
mov DWORD PTR [zcode + 1], edx
Of course, you'll have fun modifying the code section as executable pages shouldn't be writable :P (Though windows has a different view, which is a great help to viruses ::))
Quote from: Tedd on October 19, 2006, 04:00:45 PM
It's just an MASM syntax thing - zcode is a code label, and you're trying to put a dword (register) value into it. They don't match - it complains. So just force it to match :bg
mov DWORD PTR [zcode + 1], edx
Of course, you'll have fun modifying the code section as executable pages shouldn't be writable :P (Though windows has a different view, which is a great help to viruses ::))
Thankyou sir, and I can assure you this isn't for a virus, it's for a commerical pe encryptor i'm writing, which i'll give you a free copy once i'm done for your help.
Cube,
Keep in mind with a PE encryptor that newer Windows OS versions have data execution prevention available so you will have to get the ".text" and ".data" sections right or it will trigger the DEP protection on start.
Thanks for information Hutch. I added a /SECTION:.text,RWX in the linker options, seems to work fine.