Wednesday, 28 August 2013

How to get the executable given only the hex code?

How to get the executable given only the hex code?

I am learning windows assembly language with masm as my assembler and link
as my linker. I took the following assembly code and obtained the exe
.386
.model flat, stdcall
option casemap :none
extrn MessageBoxA@16 : PROC
extrn ExitProcess@4 : PROC
.code
start:
mov eax, 0
push eax
jmp msg
pgm: pop ebx
push ebx
push ebx
push eax
call MessageBoxA@16
push eax
call ExitProcess@4
msg: call pgm
db "KingKong",0
end start
C:\Arena>ml /c /coff a.asm
Microsoft (R) Macro Assembler Version 10.00.30319.01
Copyright (C) Microsoft Corporation. All rights reserved.
Assembling: a.asm
C:\Arena>link /subsystem:windows /defaultlib:kernel32 /defaultlib:user32
a.obj
Microsoft (R) Incremental Linker Version 10.00.30319.01
Copyright (C) Microsoft Corporation. All rights reserved.
The program works fine and displays the message box, Now I ran a objdump
-d a.exe and obtain the shellcode and inserted it back to obtain the
executable as
.386
.model flat, stdcall
option casemap :none
extrn MessageBoxA@16 : PROC
extrn ExitProcess@4 : PROC
.code
start:
db
0xb8,0x00,0x00,0x00,0x00,0x50,0xeb,0x0f,0x5b,0x53,0x53,0x50,0xe8,0x1b,0x00,0x00,0x00,0x50,0xe8,0x0f,0x00,0x00,0x00,0xe8,0xec,0xff,0xff,0xff,0x4b,0x69,0x6e,0x67,0x4b,0x6f,0x6e,0x67,0x00,0xcc,0xff,0x25,0x00,0x20,0x40,0x00,0xff,0x25,0x08,0x20,0x40,0x00
end start
but when I try to assemble it I get
C:\Arena>ml /c /coff b.asm
Microsoft (R) Macro Assembler Version 10.00.30319.01
Copyright (C) Microsoft Corporation. All rights reserved.
Assembling: b.asm
b.asm(10) : error A2042:statement too complex
I was able to get back the executable with the hexdump on linux and that
thread is here. I need to get back the executable using only the hexdump I
obtained on windows now. How do I do it ?

No comments:

Post a Comment