GetProcAddress32 += x86.Label(":a_dest")
GetProcAddress32 += x86.Mov("EAX", "EDX")
GetProcAddress32 += x86.Mov(
"EBX",
x86.mem("[EAX + 0x18]")) # EBX : first base ! (base of current module)
GetProcAddress32 += x86.Cmp("EBX", 0)
GetProcAddress32 += x86.Jz(":DLL_NOT_FOUND")
GetProcAddress32 += x86.Mov(
"ECX", x86.mem("[EAX + 0x30]")) # RCX = NAME (UNICODE_STRING.Buffer)
GetProcAddress32 += x86.Push("ECX")
GetProcAddress32 += x86.Call(":FUNC_STRLENW32")
GetProcAddress32 += x86.Pop("EDI") # Current name
GetProcAddress32 += x86.Mov("ECX", "EAX")
GetProcAddress32 += x86.Mov("ESI", x86.mem("[ESP + 0x18]"))
GetProcAddress32 += x86.Rep + x86.CmpsW()
GetProcAddress32 += x86.Test("ECX", "ECX")
GetProcAddress32 += x86.Jz(":DLL_FOUND")
GetProcAddress32 += x86.Mov("EDX", x86.mem("[EDX]"))
GetProcAddress32 += x86.Jmp(":a_dest")
GetProcAddress32 += x86.Label(":DLL_FOUND")
GetProcAddress32 += x86.Mov("EAX", x86.mem("[EBX + 0x3c]")) # rax = PEBASE RVA
GetProcAddress32 += x86.Add("EAX", "EBX") # RAX = PEBASE
GetProcAddress32 += x86.Add("EAX", 0x18) # ;OPTIONAL HEADER
GetProcAddress32 += x86.Mov("ECX",
x86.mem("[EAX + 0x60]")) # ;ecx = RVA export dir
GetProcAddress32 += x86.Add("ECX", "EBX") # ;ecx = export_dir
GetProcAddress32 += x86.Mov("EAX", "ECX")
GetProcAddress32 += x86.Push("EAX") # Save it
# ; EBX = BASE | EAX = EXPORT DIR
GetProcAddress32 += x86.Mov("ECX", x86.mem("[EAX + 24] "))
GetProcAddress32 += x86.Mov("EBP", "ECX") # ;EBP = NB names
def test_assembler():
CheckInstr(Mov)('EAX', 'CR3')
CheckInstr(Mov)('EDX', 'CR0')
CheckInstr(Mov)('EDI', 'CR7')
CheckInstr(Mov)('CR3', 'EAX')
CheckInstr(Mov)('CR0', 'EDX')
CheckInstr(Mov)('CR7', 'EDI')
CheckInstr(Mov)('EAX', 'ESP')
CheckInstr(Mov)('ECX', mem('[EAX]'))
CheckInstr(Mov)('EDX', mem('[ECX + 0x10]'))
CheckInstr(Mov)('EDX', mem('[EDI * 8 + 0xffff]'))
CheckInstr(Mov)('EDX', mem('[0x11223344]'))
CheckInstr(Mov)('EDX', mem('[ESP + EBP * 2 + 0x223344]'))
CheckInstr(Mov)(mem('[EBP + EBP * 2 + 0x223344]'), 'ESP')
CheckInstr(Mov)('ESI', mem('[ESI + EDI * 1]'))
CheckInstr(Mov)('EAX', mem('fs:[0x30]'))
CheckInstr(Mov)('EDI', mem('gs:[EAX + ECX * 4]'))
CheckInstr(Mov)('AX', 'AX')
CheckInstr(Mov)('SI', 'DI')
CheckInstr(Mov)('AX', 'AX')
CheckInstr(Mov)('AX', mem('fs:[0x30]'))
CheckInstr(Mov)('AX', mem('fs:[EAX + 0x30]'))
CheckInstr(Mov)('AX', mem('fs:[EAX + ECX * 4+0x30]'))
# Segment selector
CheckInstr(Mov)('SS', 'ECX')
CheckInstr(Mov)('ECX', 'SS')
CheckInstr(Mov)('EDX', 'es')
CheckInstr(Mov)('EDX', 'cs')
CheckInstr(Mov)('EDX', 'ds')
CheckInstr(Mov)('EDX', 'fs')
CheckInstr(Mov)('fs', 'eax')
CheckInstr(Mov)('fs', 'eax')
CheckInstr(Add)('EAX', 8)
CheckInstr(Add)('EAX', 0xffffffff)
CheckInstr(Add)("ECX", mem("[EAX + 0xff]"))
CheckInstr(Add)("ECX", mem("[EAX + 0xffffffff]"))
CheckInstr(Add)(mem('[EAX]'), 10)
CheckInstr(Mov)('EAX', mem('fs:[0xfffc]'))
CheckInstr(Mov)(mem('fs:[0xfffc]'), 0)
CheckInstr(Push)('ECX')
CheckInstr(Push)(mem('[ECX + 8]'))
CheckInstr(Sub)('ECX', 'ESP')
CheckInstr(Sub)('ECX', mem('[ESP]'))
CheckInstr(Inc)('EAX')
CheckInstr(Inc)(mem('[0x42424242]'))
CheckInstr(Lea)('EAX', mem('[EAX + 1]'))
CheckInstr(Lea)('ECX', mem('[EDI + -0xff]'))
CheckInstr(Call)('EAX')
CheckInstr(Call)(mem('[EAX + ECX * 8]'))
CheckInstr(Cpuid)()
CheckInstr(Movsb, expected_result='movsb byte ptr es:[edi], byte ptr [esi]')()
CheckInstr(Movsd, expected_result='movsd dword ptr es:[edi], dword ptr [esi]')()
CheckInstr(Xchg)('EAX', 'ESP')
CheckInstr(Rol)('EAX', 7)
CheckInstr(Rol)('ECX', 0)
CheckInstr(Ror)('ECX', 0)
CheckInstr(Ror)('EDI', 7)
CheckInstr(Ror)('EDI', -128)
CheckInstr(Cmp, immediat_accepted=0xffffffff)('EAX', -1)
CheckInstr(Cmp)('EAX', 0xffffffff)
CheckInstr(And)('ECX', 'EBX')
CheckInstr(And)('EAX', 0x11223344)
CheckInstr(And)('EAX', mem('[EAX + 1]'))
CheckInstr(And)(mem('[EAX + EAX]'), 'EDX')
CheckInstr(Or)('ECX', 'EBX')
CheckInstr(Or)('EAX', 0x11223344)
CheckInstr(Or)('EAX', mem('[EAX + 1]'))
CheckInstr(Or)(mem('[EAX + EAX]'), 'EDX')
CheckInstr(Shr)('EAX', 8)
CheckInstr(Shr)('EDX', 0x12)
CheckInstr(Shl)('EAX', 8)
CheckInstr(Shl)('EDX', 0x12)
CheckInstr(Not)('EAX')
CheckInstr(Not)(mem('[EAX]'))
CheckInstr(Int3)()
CheckInstr(Int)(0)
CheckInstr(Int)(3)
CheckInstr(Int)(0xff)
CheckInstr(ScasB, expected_result="scasb al, byte ptr es:[edi]")()
CheckInstr(ScasW, expected_result="scasw ax, word ptr es:[edi]")()
CheckInstr(ScasD, expected_result="scasd eax, dword ptr es:[edi]")()
CheckInstr(CmpsB, expected_result="cmpsb byte ptr [esi], byte ptr es:[edi]")()
CheckInstr(CmpsW, expected_result="cmpsw word ptr [esi], word ptr es:[edi]")()
CheckInstr(CmpsD, expected_result="cmpsd dword ptr [esi], dword ptr es:[edi]")()
CheckInstr(x86.Test)('EAX', 'EAX')
CheckInstr(x86.Test, expected_result="test edi, ecx")('ECX', 'EDI')
CheckInstr(x86.Test)(mem('[ECX + 0x100]'), 'ECX')
CheckInstr(x86.Test)('EAX', 0x11223344)
CheckInstr(x86.Test, immediat_accepted=-1)('EAX', 0xffffffff)
CheckInstr(x86.Test)('ECX', 0x42)
assert x86.Test(mem('[ECX + 0x100]'), 'ECX').get_code() == x86.Test('ECX', mem('[ECX + 0x100]')).get_code()
assert Xchg('EAX', 'ECX').get_code() == Xchg('ECX', 'EAX').get_code()
code = MultipleInstr()
code += Nop()
code += Rep + Nop()
code += Ret()
print(repr(code.get_code()))
assert code.get_code() == b"\x90\xf3\x90\xc3"