News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

Moving instruction memory locations

Started by www.:).com, November 06, 2010, 12:49:39 AM

Previous topic - Next topic

www.:).com

I'm trying to create a program that will rearrange instructions as needed. I want to move the instruction and it's operands into memory, to be called later. How would I do this?

theunknownguy

Quote from: www.:).com on November 06, 2010, 12:49:39 AM
I'm trying to create a program that will rearrange instructions as needed. I want to move the instruction and it's operands into memory, to be called later. How would I do this?

Need to know the opcoding encoding, i recommend you a good lecture into Intel manuals and www.sandpile.org.

Inside sandpile you can find the intel manuals too:

http://www.sandpile.org/docs/intel/index.htm

Read alot and youll make it within a day or two  :toothy

May i ask why you need this?

www.:).com

Yes you may ask, I am testing a method I have for making a thread handler, you can see this on one of my other posts. What I'm trying to do is make two threads one to handle drawing the mouse cursor and another for the program. What I'm attempting is to modify each thread by sending one instruction at a time into a memory location then adding to the next consecutive memory location a jump instruction back to my thread handler.

Thanks for your help.

theunknownguy

Quote from: www.:).com on November 06, 2010, 01:26:03 AM
Yes you may ask, I am testing a method I have for making a thread handler, you can see this on one of my other posts. What I'm trying to do is make two threads one to handle drawing the mouse cursor and another for the program. What I'm attempting is to modify each thread by sending one instruction at a time into a memory location then adding to the next consecutive memory location a jump instruction back to my thread handler.

Thanks for your help.

Sounds like alot of resources, you know self modify have a great penalty. Are you sure this is the best way to make it? or you just testing?

Caused sounds pretty complicated to an already complicated thing...

www.:).com

I'm just testing, but if it works I could use it in some applications.

theunknownguy

Quote from: www.:).com on November 06, 2010, 01:35:53 AM
I'm just testing, but if it works I could use it in some applications.

Well you just need to read, ill be glad to help but, the same thing you want to do, can be used for malware too...
Specific for metamorph code of virus or even make a virtualizator.

I dont doubt of your intentions but the forum have some rules about that kind of things.  ::)

www.:).com

I know that there are restrictions to virus programming and yes this is NOT for a virus. I didn't even know that this topic was related to viruses, thanks for telling me.

hutch--

What you are trying to do is no big deal except for the normal security issues, the code section is not normally writable unless you link your application that way and then your app becomes a security issue that at least some AV products will catch with a writable code section.

Altering code on the fly comes with some big penalties and it is generally of little use as there are simply better faster ways of doing things like this. Its almost exclusively the realm of virus code to modify a running app on the fly and if any of these questions or examples even vaguely look like virus code we will instantly shut it down.
Download site for MASM32      New MASM Forum
https://masm32.com          https://masm32.com/board/index.php

www.:).com

Quote from: hutch-- on November 06, 2010, 03:15:06 AM
What you are trying to do is no big deal except for the normal security issues, the code section is not normally writable unless you link your application that way and then your app becomes a security issue that at least some AV products will catch with a writable code section.

Altering code on the fly comes with some big penalties and it is generally of little use as there are simply better faster ways of doing things like this. Its almost exclusively the realm of virus code to modify a running app on the fly and if any of these questions or examples even vaguely look like virus code we will instantly shut it down.

Is this topic allowed in the form?

dedndave

no - not really
i think that's the point that Hutch has politely tried to make   :bg

Forum Rules