public Byte[] Assemble(Boolean isProcess32Bit, String assembly, UInt64 baseAddress, out String logs)
{
logs = "Starting instruction assembly" + Environment.NewLine;
if (assembly == null)
{
logs += "No assembly code given" + Environment.NewLine;
return(null);
}
// Add header information about process
if (isProcess32Bit)
{
assembly = String.Format("use32\n" + "org 0x{0:X8}\n", baseAddress) + assembly;
}
else
{
assembly = String.Format("use64\n" + "org 0x{0:X16}\n", baseAddress) + assembly;
}
logs += assembly + Environment.NewLine;
Byte[] result;
try
{
// Call C++ FASM wrapper which will call the 32-bit FASM library which can assemble all x86/x64 instructions
result = FasmNet.Assemble(assembly);
logs += "Assembled byte results:" + Environment.NewLine;
foreach (Byte next in result)
{
logs += next.ToString("X") + " ";
}
logs += Environment.NewLine;
}
catch (Exception ex)
{
logs += "Error:" + ex.ToString() + Environment.NewLine;
result = null;
}
return(result);
}
internal static IntPtr MakeCodeCave(string[] v)
{
IntPtr codeCave = Marshal.AllocHGlobal(128);
var preamble = new string[] {
"use32",
"org " + codeCave
};
var asm = preamble.Concat(v).ToArray();
byte[] code = FasmNet.Assemble(asm);
Marshal.Copy(code, 0, codeCave, code.Length);
// Make executable
uint dwOldProtection;
Kernel32.VirtualProtect(codeCave, (uint)code.Length, 0x40, out dwOldProtection);
return(codeCave);
}
internal static void Install(HookType hook)
{
var hookLocation1 = new IntPtr(0x005D53B1);
var hookLocation = new IntPtr(0x005D5590);
IntPtr codeCave2 = Marshal.AllocHGlobal(4);
IntPtr codeCave1 = Marshal.AllocHGlobal(128);
byte[] code1 = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave1,
"push esi",
"push edi",
"mov esi, dword[ebx+0x10]",
"mov dword[" + codeCave2 + "],esi",
"lea esi, dword[ebx+0x78]",
"jmp " + (hookLocation1 + 5)
});
Marshal.Copy(code1, 0, codeCave1, code1.Length);
HookHelper.Jump(hookLocation1, codeCave1);
IntPtr codeCave = Marshal.AllocHGlobal(128);
byte[] code = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave,
"push dword [ebp+0x8]",
"push dword [" + codeCave2 + "]",
"call " + Marshal.GetFunctionPointerForDelegate(hook),
"pop edi",
"pop esi",
"pop ebx",
"leave",
"retn 8"
});
Marshal.Copy(code, 0, codeCave, code.Length);
HookHelper.Jump(hookLocation, codeCave);
}
public void Hook()
{
IntPtr taskPtr = Marshal.AllocCoTaskMem(1024);
//
var hookedFuncBytes = FasmNet.Assemble(new[] {
"use32",
"pushad",
$"call {this.CallbackAddress - (int)taskPtr}",
"popad",
"call dword [edx+12]",
"pop ebp",
"ret 12"
});
WinAPI.VirtualProtect(taskPtr, hookedFuncBytes.Length, (int)WinAPI.Protection.PAGE_EXECUTE_READWRITE, out int x);
Memory.WriteBytes(taskPtr, hookedFuncBytes);
SetJump(taskPtr);
}
internal static void Install(HookType hook)
{
var hookLocation = new IntPtr(0x0A2B2E8);
IntPtr codeCave = Marshal.AllocHGlobal(128);
byte[] code = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave,
"pushad",
"call " + Marshal.GetFunctionPointerForDelegate(hook),
"popad",
"retn"
});
Marshal.Copy(code, 0, codeCave, code.Length);
Marshal.WriteIntPtr(hookLocation, codeCave);
}
public void AssembleWithError()
{
// Arrange
const string mnemonics = "use32\nretnj";
// Act
try
{
FasmNet.Assemble(mnemonics);
Assert.Fail("The above line must throw an error.");
}
catch (FasmAssemblerException ex)
{
// Assert
Assert.AreEqual(2, ex.ErrorLine, "The error does not indicate the correct line.");
Assert.AreEqual(6, ex.ErrorOffset, "The error does not indicate the correct offset.");
Assert.AreEqual(FasmErrors.IllegalInstruction, ex.ErrorCode, "The kind of the error was not found.");
Assert.AreEqual(mnemonics, ex.Mnemonics);
}
}
internal static void Install(HookType hook)
{
var hookLocation = new IntPtr(0x004078E1);
IntPtr codeCave = Marshal.AllocHGlobal(128);
byte[] code = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave,
"pushad",
"push edx",
"call " + Marshal.GetFunctionPointerForDelegate(hook),
"popad",
"call 0x00409880",
"jmp " + (hookLocation + 5)
});
Marshal.Copy(code, 0, codeCave, code.Length);
HookHelper.Jump(hookLocation, codeCave);
}
internal static void Install(HookType hook)
{
var hookLocation = new IntPtr(0x007B25F6);
IntPtr codeCave = Marshal.AllocHGlobal(128);
byte[] code = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave,
"mov dword[esi+0x88],ecx",
"pushad",
"push dword[esi+0x2C]",
"call " + Marshal.GetFunctionPointerForDelegate(hook),
"popad",
"jmp " + (hookLocation + 6)
});
Marshal.Copy(code, 0, codeCave, code.Length);
HookHelper.Jump(hookLocation, codeCave);
}
internal static void Install()
{
var hookLocation = new IntPtr(0x005D2EF1);
IntPtr codeCave = Marshal.AllocHGlobal(128);
_speedModifierLocation = Marshal.AllocHGlobal(4);
byte[] code = FasmNet.Assemble(new[]
{
"use32",
"org " + codeCave,
"mov ebx, dword[ecx*0x4+eax]",
"mov dword[" + _speedModifierLocation + "], ebx",
"test ebx, ebx",
"jmp " + (hookLocation + 5)
});
Marshal.Copy(code, 0, codeCave, code.Length);
HookHelper.Jump(hookLocation, codeCave);
}
/// <summary>
/// Assembles the received request and sends back information to the client.
/// </summary>
/// <param name="mnemonics">The assembly code to be assembled.</param>
/// <param name="clientSocket">The socket used for communication with the client. which sent the request.</param>
private static void Assemble(string[] mnemonics, ReloadedSocket clientSocket)
{
// Send back empty message struct
Message.MessageStruct messageStruct = new Message.MessageStruct
{
// Client will likely ignore this anyway (but shouldn't).
MessageType = ( ushort )MessageTypes.Assemble
};
// Try Assembly
// Assemble the bytes
try
{ messageStruct.Data = FasmNet.Assemble(mnemonics); }
// Failed to Assemble
// Return nop on failure.
catch
{ messageStruct.Data = new byte[1] {
0x90
}; }
// Return back.
clientSocket.SendData(messageStruct, false);
}
private static byte[] FasmNETAssemble(string[] source)
{
return(FasmNet.Assemble(source));
}
private byte[] Assemble(string mnemonic, IntPtr baseAddress)
{
mnemonic = $"use32\norg 0x{(object)baseAddress.ToInt64():X8}\n" + mnemonic;
return(FasmNet.Assemble(mnemonic));
}
public void ObjectAssembleWithOrigin()
{
// Arrange
var fasm = new FasmNet();
// Act
fasm.AddLine("use32");
fasm.AddLine("jmp {0}", 0x2000);
var asm = fasm.Assemble(new IntPtr(0x1000));
// Assert
CollectionAssert.AreEqual(new byte[] { 0xE9, 0xfb, 0x0f, 0x00, 0x00 }, asm);
}
public void ObjectClear()
{
// Arrange
var fasm = new FasmNet();
// Act
fasm.AddLine("retn");
fasm.Clear();
fasm.AddLine("push eax");
fasm.AddLine("pop {0}", "eax");
fasm.InsertLine(0, "use32");
var asm = fasm.Assemble();
// Assert
CollectionAssert.AreEqual(new byte[] { 0x50, 0x58 }, asm);
}
