MemCMP_GreaterThan // If szSrc > szDest // The memory blocks are equal. in Visual C#

Drawer Code39 in Visual C# MemCMP_GreaterThan // If szSrc > szDest // The memory blocks are equal.

XOR EAX , EAX JMP MemCMP_Done MemCMP_LessThan: MOV EAX , 0FFFFFFFFh JMP MemCMP_Done MemCMP_GreaterThan: MOV EAX , 1 JMP MemCMP_Done MemCMP_Done: } __asm MOV iReturn , EAX return ( iReturn ) ; }

// Return -1.

Common Assembly-Language Constructs Up to this point, I've just been covering basic assembly-language instructions. Now I want to start looking at various assembly-language constructs that you'll encounter and explain how you identify them and translate them into higher-level operations. FS Register Access In Win32 operating systems, the FS register is special because the pointer to the thread information block (TIB) is stored in it. The TIB is also called the thread environment block (TEB). The TIB holds all the thread-specific data so that the operating system can keep your thread access straight. This thread-specific data includes all the structured exception handling (SEH) chains, thread local storage, the thread stack, and other information needed internally. For more information about SEH, see 13. For an example of thread local storage, see the MemStress discussion in 17. The TIB is stored in a special memory segment, and when the operating system needs to access the TIB, it converts the FS register plus an offset into a normal linear address. When you see an instruction accessing the FS register, one of the following operations is underway: an SEH frame is being created or destroyed, the TIB is being accessed, or thread local storage is being accessed. Creating or Destroying an SEH Frame The first instructions after setting up the stack frame are often something like the following code, which is standard code to start a __try block. The first node in the chain of SEH handlers is at offset 0 in the TIB. In the following disassembly, the compiler is pushing a data value and a pointer to a function on the stack. That function is __except_handler3 in Windows 2000 code. In Windows XP operating system code, the special function is _SEH_prolog. The first MOV instruction is accessing the TIB; the offset of 0 indicates that a node is being added to the top of the exception chain. The last two instructions indicate where the code moves the actual node to the chain. PUSH 004060d0 PUSH 004014a0 MOV MOV EAX , FS:[00000000] DWORD PTR FS:[0] , ESP PUSH EAX

Although this example is nice and clean, the compiler doesn't always produce such tidy code. Sometimes it spreads the SEH frame creation throughout the code. Depending on the code generation and optimization flags, the compiler moves instructions around to take better advantage of the CPU's pipelining. The following disassembly example, in which KERNEL32.DLL symbols are loaded, shows the start of the Microsoft Windows 2000 IsBadReadPtr function: PUSH EBP MOV EBP , ESP PUSH 0FFFFFFFFh PUSH 77E86F40h PUSH OFFSET __except_handler3 MOV MOV EAX , DWORD PTR FS:[00000000h] DWORD PTR FS:[0] , ESP 302 PUSH EAX

What's interesting about Windows XP is that the operating system code seems to have custom exception handling that generates a call to _SEH_prolog, where most of the preceding code executes. That leads to much smaller code, and based on looking at the assembly language, it looks as if Windows XP functions that use SEH are using custom prolog and epilog to do their magic. Destroying an SEH frame is much more mundane than creating one, as the following code shows. The key item to remember is that any access of FS:[0] means SEH. MOV ECX , DWORD PTR [EBP-10h] MOV DWORD PTR FS:[0] , ECX Accessing the TIB The value at FS:[18] is the linear address of the TIB structure. In the following code, the Windows XP implementation of GetCurrentThreadId gets the linear address of the TIB, and at offset 0x24, it gets the actual thread ID. GetCurrentThreadId: MOV EAX , FS:[00000018h] MOV EAX , DWORD PTR [EAX+024h] RET Accessing Thread Local Storage Thread local storage is a Win32 mechanism that allows you to have variables that are global, but each thread has its own instance of the global variables. Offset 0x2C in the TIB structure is the pointer to the thread local storage array. The following disassembly shows how to access the thread local storage pointer. MOV ECX , DWORD PTR FS:[2Ch] MOV EDX , DWORD PTR [ECX+EAX*4] Structure and Class References Because so much of Windows development is structures and classes, I want to spend some time going over how you access that memory. Although structures and classes are convenient to deal with in high-level languages, at the assembly-language level they really don't exist. In high-level languages, a structure and a class are just shorthand ways to specify offsets into a blob of memory. For the most part, the compilers lay out memory for your structures and classes just as you specify. Occasionally, the compiler will pad fields to keep them on natural memory boundaries, which for x86 CPUs is 4 or 8 bytes. Structure and class references are denoted by a register and a memory offset. In the following MyStruct structure, the comments to the right of each member show the offset from the beginning of the structure for each member. After the MyStruct definition, I show various ways of accessing the structure fields. typedef struct tag_MyStruct { DWORD dwFirst ; char int szBuff[ 256 ] ; iVal ; // 0-byte offset // 4-byte offset // 260-byte offset

} MyStruct , * PMyStruct ; void FillStruct ( PMyStruct pSt ) 303

{ char szName[] = "Pam\n" ; __asm { MOV to show // what they look like in a disassembly. The // inline assembler allows you to use the normal // <struct>.<field> references. // C code : pSt->dwFirst = 23 ; MOV DWORD PTR [EAX] , 17h EAX , pSt // Place pSt into EAX. Below, I'm using the // direct offsets in the assembly language