Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Defining Bytes in GCC Inline Assembly in Dev-C++(.ascii in AT&T syntax on Windows)

The code below is just showing a Message Box on the screen.
The addresses are hardcoded to facilitate:

int main ()
{
    asm("xorl %eax, %eax        \n"
        "xorl %ebx, %ebx        \n"
        "xorl %ecx, %ecx        \n"
        "xorl %edx, %edx        \n"
        "pushl %ecx             \n" //$0x0
        "pushl $0x20206c6c      \n" //"  ll"
        "pushl $0x642e3233      \n" //"d.23"
        "pushl $0x72657375      \n" //"resu"
        "movl %esp, %ecx        \n" //store "user32.dll" address in %ecx
        "movl $0x7c801d7b, %ebx \n" //store address of LoadLibraryA in %ebx
        "pushl %ecx             \n"
        "call *%ebx             \n"
        "movl $0xef30675e, %ecx \n"
        "addl $0x11111111, %ecx \n"
        "pushl %ecx             \n"
        "pushl $0x42656761      \n"
        "pushl $0x7373654d      \n"
        "movl %esp, %ecx        \n"
        "pushl %ecx             \n"
        "pushl %eax             \n"
        "movl $0x7c80ae40, %ebx \n"
        "call *%ebx             \n"
        "movl %esp, %ecx        \n"
        "xorl %edx, %edx        \n"
        "pushl %edx             \n"
        "pushl %ecx             \n"
        "pushl %ecx             \n"
        "pushl %edx             \n"
        "call *%eax             \n"
        "xorl %eax, %eax        \n"
        "pushl %eax             \n"
        "movl $0x7c81cb12, %eax \n"
        "call *%eax             \n"
    );
}

(I didn't comment all the code because my question is not really about the code)

My question is: Is there a way to write the string "user32.dll" in assembly inline without pushing manually to the stack? I mean like this in NASM: db 'Hello'

I know that in AT&T syntax I could do .ascii 'Hello' or .string 'Hello' but how about in gcc inline?

Please note that I'm using Dev-C++ on Windows XP SP3

Thanks!

like image 921
jyz Avatar asked Sep 14 '10 19:09

jyz


People also ask

What is inline assembly in embedded system?

In computer programming, an inline assembler is a feature of some compilers that allows low-level code written in assembly language to be embedded within a program, among code that otherwise has been compiled from a higher-level language such as C or Ada.

Does GCC support inline assembly?

GCC provides two forms of inline asm statements. A basic ``asm`` statement is one with no operands (see Basic Asm - Assembler Instructions Without Operands), while an extended ``asm`` statement (see Extended Asm - Assembler Instructions with C Expression Operands) includes one or more operands.

How inline assembly can be useful in large software projects in C?

Inline assembly is used mostly for specific purposes: to ensure semantics on multiple cores, to optimize performance, to access functionality that is unavailable in C, and to implement arithmetic operations.


1 Answers

Yes, by making use of assembler directives inside your inline assembler. The trick is in putting the string in the right place (the data section), which you can do by switching using .section .data, and then switching back again with .section .text.

You must give the data a label so that you can refer to it; I would recommend using the local label syntax here (where the label is a number, e.g. 1:, and you reference it as either 1b for the first 1: label backwards, or 1f for the first 1: label forwards - see the GNU assembler documentation for more details).

Like this:

int main(void)
{
  asm(".section .data      \n"
      "1: .asciz \"Hello\" \n"
      ".section .text      \n"
      "pushl $1b           \n"
      "call _puts          \n"
      "add $4, %esp        \n"
     );
  return 0;
}

I don't have a Windows system handy to test this on, but it compiles OK and looks like it should be doing the right thing using a MinGW cross-compiler on Linux (I believe Dev-C++ is based on MinGW).

Note: this technique is generally applicable when using a GNU toolchain. If you're building ELF binaries (e.g. native Linux), there is a neater way to switch back to the text section, which is to use .previous, which means "whatever the section before the previous .section was". (The above example works on Linux if you change _puts to puts to account for different symbol prefixing conventions.)

like image 110
Matthew Slattery Avatar answered Oct 04 '22 04:10

Matthew Slattery