AA 64bit save string to file

Memory scanning, code injection, debugger internals and other gamemodding related discussion
Post Reply
User avatar
kantoboy69
Expert Cheater
Expert Cheater
Posts: 90
Joined: Fri Aug 30, 2019 5:33 am
Reputation: 50

AA 64bit save string to file

Post by kantoboy69 »

For windows-64 bit AutoAssembly save/append string to file snippet

Code: Select all

// code snippet to save string to file
code:
  mov    qword ptr [buffer], rsi  // assuming rsi have the string buffer
  pushfq
  push    rax
  push    rbx
  push    rcx
  push    rdx
  push    r8
  push    r9
  call    savefile
  pop     r9
  pop     r8
  pop     rdx
  pop     rcx
  pop     rbx
  pop     rax
  popfq

// Function Call savefile
savefile:
  sub     rsp, 80
  mov     rax, 0
  xor     rax, rsp
  mov     [rsp+70], rax
  mov     rdx, qword ptr [buffer]     // buffer to write
  mov     qword ptr [rsp+48], rdx // buffer to write
  mov     qword ptr [rsp+58], 0
  xor     eax, eax
  xor     r9d, r9d
  mov     [rsp+30], 0
  mov     rcx, FileName              // full path filename
  mov     [rsp+28], 80
  mov     qword ptr [rsp+40], 0   // Bytes written
  xor     r8d, r8d
  lea     edx, [r9+4]
  mov     [rsp+68], al
  mov     [rsp+20], 4
  call    CreateFileA
  mov     rbx, rax
  mov     r8, FFFFFFFFFFFFFFFF
  mov     rax, qword ptr [rsp+48]
aloop:                                      // get string length (null terminated)
  inc     r8
  cmp     byte ptr [rax+r8], 0
  jnz     short aloop                    // loop until end of string
  mov     byte ptr [rax+r8], 0a      // pad linefeed
  inc     r8                                  // Length of string
  lea     r9, [rsp+40]
  mov     qword ptr [rsp+20], 0
  mov     rdx, [rsp+48]
  mov     rcx, rbx
  call    WriteFile
  mov     r8, qword ptr [rsp+40]
  dec     r8
  mov     rax, qword ptr [rsp+48]
  mov     byte ptr [rax+r8], 0
  mov     rcx, rbx
  call    CloseHandle
  add     rsp, 80
  retn
  nop
  nop
  nop
FileName:
  db 'D:\games\myvaluesave.txt',0


User avatar
kantoboy69
Expert Cheater
Expert Cheater
Posts: 90
Joined: Fri Aug 30, 2019 5:33 am
Reputation: 50

Re: AA 64bit save string to file

Post by kantoboy69 »

Not yet finish with some subroutines
But this will append to file

Yeah I know, bad naming conventions :D :D :D :D :D

Update => Tutorial-x86_64_v2.CT

// e.g. string buffer[50]
// buffer offset 0 4 bytes is length of string
// buffer offset 4 is the string buffer
// buffer offset 50+4+1 is buffer offset 37 which is the null termination
buffer:
dd 0 // you can initialize the size if you know or use pascal_strlen
bufferstr:
db 'This is a test'
buffer+37:
db 0

Code: Select all

StrAppendFile(&filename,&buf) - append string buf to filename
inttohex(&buf, val) - convert val to hex string into string buf
inttostr(&buf, val) - convert val to string into string buf
floattostr(&buf, val) - convert val to float string into buf
pascal_strlen(&buf) - when length is not yet initialize but there is data
pascal_strclear_by_length(&buf) - when string buf have len and data, clear
pascal_strcat(&dst, &src) - concatenate string src to string dst
strcat_to_pascal_buf(&dst, &src) - concatenate src (null terminated) to string dst

Note:
Subroutines are not optimize. It's easier for me to debug this way.
The functions save the registers it uses except for flags. So you need to push flags and registers you use.
floatstr uses simple float

My todo list:
add normal strlen
add normal StrAppendFile (filename, charbuf, size)
add strcpy
add normal strcat
add strcmp
add stricmp
add copywstrtostr
Attachments
Tutorial-x86_64_v2.CT
floattostr(&buf, val) - convert val to float string into buf
pascal_strcat(&dst, &src) - concatenate string src to string dst
strcat_to_pascal_buf(&dst, &src) - concatenate src (null terminated) to string dst
(21.69 KiB) Downloaded 109 times
Tutorial-i386_v2.CT
32-bit version
(20.21 KiB) Downloaded 110 times
Tutorial-x86_64_v1.CT
StrAppendFile(&filename,&buf) - append string buf to filename
inttohex(&buf, val) - convert val to hex string into string buf
inttostr(&buf, val) - convert val to string into string buf
pascal_strlen(&buf) - when length is not yet initialize but there is data
pascal_strclear_by_length(&buf) - when string buf have len and data, clear
(10.55 KiB) Downloaded 108 times

Post Reply

Who is online

Users browsing this forum: No registered users