Reputation: 39
i am using assembly to get the address to the process' PEB, but i cant compile it.
this is the x64 asm code, but it gives me the error "undefined symbol: rax" which makes no sense. doesnt even matter if i compile it in x86 or x64. i have a separate .asm file that has the same function but with x86 registers and such.
.386
.model flat, C
.code
get_peb_internal_x64 proc
assume gs:nothing
mov rax, gs:[60h]
ret
get_peb_internal_x64 endp
end
-- now the x86 version that does compile always
.386
.model flat, C
.code
get_peb_internal_x86 proc
assume fs:nothing
mov eax, fs:[30h]
ret
get_peb_internal_x86 endp
end
Upvotes: 1
Views: 2497
Reputation: 39
I have solved my issue thanks to @MichaelPetch
The problem was caused by the fact that i had the .model and .386 directives that apparently as ive read myself just now, arent used in x64 masm, and also the assume gs:nothing.
I have adapted my code into a single file and it ended up this way:
ifdef rax
else
.386
.model flat, C
endif
.code
ifdef rax
get_peb_internal_x64 proc
mov rax, gs:[60h]
ret
get_peb_internal_x64 endp
else
get_peb_internal_x86 proc
assume fs:nothing
mov eax, fs:[30h]
ret
get_peb_internal_x86 endp
endif
end
Upvotes: 2