0
votes

I got a simple code and it gives me a compiler error for no reason

inline assembler syntax error in 'opcode'; found 'constant'

DWORD connectFunctionAddressReturn = 0x775368F7;

int __cdecl ws2_32_connect_hook_output(SOCKET s, const struct sockaddr *name, int namelen) {
    struct sockaddr_in *in = (struct sockaddr_in *)connect_name;
    printf("Attempting connect %d.%d.%d.%d : %d\n", in->sin_addr.S_un.S_un_b.s_b1, in->sin_addr.S_un.S_un_b.s_b2, in->sin_addr.S_un.S_un_b.s_b3, in->sin_addr.S_un.S_un_b.s_b4, htons(in->sin_port));
}


void __declspec(naked) ws2_32_connect_hook(void) { //ws2_32.connect = 775368F5

    __asm {
        PUSHAD //To be in safe environment
        PUSHFD //To be safe environment

        PUSH 0x10
        PUSH DWORD PTR SS:[EBP+0x8]
        PUSH DWORD PTR DS:[ESI+0x14]
        CALL DWORD PTR ws2_32_connect_hook_output  //<-- ERROR HERE
        ADD ESP, 0xC //clean __cdecl,4,8,C

        POPFD //Finish being in safe environment
        POPAD //Finish being in safe environment
        JMP connectFunctionAddressReturn // <-- ERROR HERE
    }
}
1
Did you possibly mean JMP [connectFunctionAddressReturn]?Jester
Tried that the error still staysSSpoke
Also not CALL DWORD PTR ws2_32_connect_hook_output just CALL ws2_32_connect_hook_output.Jester
Why are you doing this? pushad / popad is slow, and pushfd / popfd is quite slow (has to be microcoded because the same instruction in kernel mode can set/clear IF (interrupts enabled) and other important system flags). agner.org/optimize. Why can't you just write this in C with a normal function call to ws2_32_connect_hook_output, and let a call to a function pointer void (*connectFunctionAddressReturn)(void) compile into an optimized tailcall with jmp? It seems to me like writing a naked function with inline asm is gaining you nothing vs. stand-alone asm, or plain C++.Peter Cordes
@Peter Cordes I'm trying to use page exceptions / debug registers which require raw assembly and I don't want to mess with any of the registers while I get the values out at a specific area.SSpoke

1 Answers

0
votes

solved it, I had CALL AND JMP defined so it errored in ASM code.

#define CALL 0xE8
#define JMP 0xE9