mscofield Posted July 17, 2010 Posted July 17, 2010 hello friends , i want to compile the deroko example non-intrusive loader create in tasm32 for execryptor target, but ever that i compile show me the same message this is a log Microsoft Windows XP [Versión 5.1.2600] © Copyright 1985-2001 Microsoft Corp. C:\Tasm32\loader>makeloader C:\Tasm32\loader>..\tasm32\tasm32 /ml /z /m9 /q loader Turbo Assembler Version 5.3 Copyright © 1988, 2000 Inprise Corporation Assembling file: loader.ASM Error messages: None Warning messages: None Passes: 2 C:\Tasm32\loader>..\tasm32\tlink32 -x /Tpe /aa /c loader,,,..\importlib\import32.lib Turbo Link Version 1.6.71.0 Copyright © 1993,1996 Borland International Error: Unresolved external 'VirtualAllocEx' referenced from module loader.ASM C:\Tasm32\loader>..\tasm32\pewrite debugger.exe C:\Tasm32\loader> and not resolve the call to VirtualAllocEx the exe is create but the call to VirtualAllocEx not resolved. i try with other asm more easy and the exe is create fine until not use Call VirtualAllocEx. In all asm that i use CAll VirtualAllocEx the obj is create fine, but tlink showme the same error, Error: Unresolved external 'VirtualAllocEx' referenced from module ...... any idea to fix this.. regards and sorry for my bad english . br mscofield
human Posted July 17, 2010 Posted July 17, 2010 well there is always problem with someone else code, so thing 1st to do is change paths in bat filecant resolve or link due it doesnt see import32.lib, there are all api's tasm 5.3 can handle.
mscofield Posted July 17, 2010 Author Posted July 17, 2010 @human, first to all thanks for your answer.the path to import32.lib is fine. ..\importlib\import32.lib, iam using tasm 5.3.The filename is loader_m.asmmy bat file is this:make_loader.bat-------------------..\tasm32\tasm32 /ml /z /m9 /q loader_m..\tasm32\tlink32 -x /Tpe /aa /c loader_m,,,..\importlib\import32.lib..\tasm32\pewrite loader_m.exe@echo offdel loader_m.obj----------------------and my importlib is selected ok, the path is ..\importlib\import32.lib, The problem is that the unique api of kernel32 cant not resolve the compiler is this., the program use VirtualProtect,LoadLibrary and others and work fine except VirtualAllocEx.BRsorry for my englishWhat can be the problem?
evlncrn8 Posted July 18, 2010 Posted July 18, 2010 sigh.. its because tasm is OLD and DEAD and the import lib you're using doesn'tknow the Ex functions (because they came later.. with hmm win2k?)...so either move to masm (probably a good idea) or use getprocaddress to get the'unknown' api's....
human Posted July 18, 2010 Posted July 18, 2010 dont talk bull**** due my import32.lib has VirtualAllocEx pointing to kernel32.dll
evlncrn8 Posted July 19, 2010 Posted July 19, 2010 sigh again.. yours might, his doesnt seem to..so go ahead, be all high and mighty.. i really don't give a ****...use out of date tools ,what do you really expect?..
BoB Posted July 19, 2010 Posted July 19, 2010 (edited) There is updated TASM, try using that.Turbo Assembler Version 5.4 Copyright (c) 1988, 2009 CodeGear Edited July 19, 2010 by BoB
JMC31337 Posted July 30, 2010 Posted July 30, 2010 (edited) extern VirtualAllocEx:PROCtasm32 /ml tlink32 -x -c -aa FOR no console modeortlink32 -x -c -apand dont forget your tasm.cfg file with -IC:\tasm\includeif your going old schoolLPVOID WINAPI VirtualAllocEx( __in HANDLE hProcess, __in_opt LPVOID lpAddress, __in SIZE_T dwSize, __in DWORD flAllocationType, __in DWORD flProtect);push flprotect push flAllocpush dwsizepush lpAddpush hprocesscall VirtualAllocExor add a Localsjumps.Model Flat ,StdCalland use 1 linercall VirtualAllocEx,hprocess,lpadd,dwsize,flAlloc,flprotif im wrong someone can correct it....g'luck Edited July 30, 2010 by JMC31337
JMC31337 Posted July 30, 2010 Posted July 30, 2010 (edited) extern VirtualAllocEx:PROCtasm32 /ml tlink32 -x -c -aa FOR no console modeortlink32 -x -c -apand dont forget your tasm.cfg file with -IC:\tasm\includeif your going old schoolLPVOID WINAPI VirtualAllocEx( __in HANDLE hProcess, __in_opt LPVOID lpAddress, __in SIZE_T dwSize, __in DWORD flAllocationType, __in DWORD flProtect);push flprotect push flAllocpush dwsizepush lpAddpush hprocesscall VirtualAllocExor add a Localsjumps.Model Flat ,StdCalland use 1 linercall VirtualAllocEx,hprocess,lpadd,dwsize,flAlloc,flprotif im wrong someone can correct it....g'luckdamn, even i was wrong about VirtualAlloc... i cant link it with tlink32 either.. lemme see if i cant call it directly thru kernel32.dll, i need a break from browser hijacking anyways... Edited July 30, 2010 by JMC31337
JMC31337 Posted July 30, 2010 Posted July 30, 2010 (edited) hello friends , i want to compile the deroko example non-intrusive loader create in tasm32 for execryptor target, but ever that i compile show me the same message this is a log Microsoft Windows XP [Versión 5.1.2600] © Copyright 1985-2001 Microsoft Corp. C:\Tasm32\loader>makeloader C:\Tasm32\loader>..\tasm32\tasm32 /ml /z /m9 /q loader Turbo Assembler Version 5.3 Copyright © 1988, 2000 Inprise Corporation Assembling file: loader.ASM Error messages: None Warning messages: None Passes: 2 C:\Tasm32\loader>..\tasm32\tlink32 -x /Tpe /aa /c loader,,,..\importlib\import32.lib Turbo Link Version 1.6.71.0 Copyright © 1993,1996 Borland International Error: Unresolved external 'VirtualAllocEx' referenced from module loader.ASM C:\Tasm32\loader>..\tasm32\pewrite debugger.exe C:\Tasm32\loader> and not resolve the call to VirtualAllocEx the exe is create but the call to VirtualAllocEx not resolved. i try with other asm more easy and the exe is create fine until not use Call VirtualAllocEx. In all asm that i use CAll VirtualAllocEx the obj is create fine, but tlink showme the same error, Error: Unresolved external 'VirtualAllocEx' referenced from module ...... any idea to fix this.. regards and sorry for my bad english . br mscofield post the source code you are trying to compile mscofield... u can use the old trick from CodeBreakers in such a way that i did with Tasm32 WSASTARTUP over at VX Heavens or use GetProcAddress we need to see your source.... but yu load VirtualAllocEx directly thru the Kernel32 with this.... ;tams32 /ml getproc;tlink32 -x -c -aa getproc,,,import32;thnx to DiA[rRlf].386PLocalsjumps.Model Flat ,StdCallinclude windows.incextrn LoadLibraryA:PROC extrn GetProcAddress:PROC extrn ExitProcess:PROC .dataszDLL db 'C:\Windows\System32\Kernel32.dll',0szAPI db 'VirtualAllocEx',0 .codestart:push offset szDLL call LoadLibraryA push offset szAPI push eax call GetProcAddress push ?? //Whatever your variables arepush ?? push ?? push ??push ??call eax //EAX=VirtualAllocEx call ExitProcessend start Edited July 31, 2010 by JMC31337
ghandi Posted July 31, 2010 Posted July 31, 2010 Just wondering, why can't you use the .lib files which come with BC++ Builder (as does TASM), they'd have to be more current than the files floating around atm would't they? I'm asking this in ignorance after reading an article somewhere, i don't use TASM myself or BC++ for that matter, i'm a MSVC and MASM guy. HR, Ghandi
Peter Ferrie Posted August 4, 2010 Posted August 4, 2010 TASM32 does not support VirtualAllocEx. You need to use GetModuleHandle("kernel32") and GetProcAddress("VirtualAllocEx") to use it.Or pick a different assembler, like MASM32.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now