0

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly:

__asm {
    CMP [ebp + 8], 1
    JNZ short 01311723
    jmp [jmpBackAddy]
}

But Visual Studio gives me that error:

Severity Code Description Project File Line Suppression State Error C2400 inline assembler syntax error in 'first operand'; found 'constant'

What am I doing wrong? I though I can copy out the assembly of OllyDbg but Visual Studio does not accept it

closed as off-topic by Guntram Blohm supports Monica, perror, usr2564301, peter ferrie, jvoisin Aug 13 '16 at 15:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on software development are off-topic here, but can be asked on Stack Overflow." – Guntram Blohm supports Monica, perror, usr2564301, peter ferrie, jvoisin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • My first guess is the compiler doesn't infer the operand size from arg_0, so it doesn't know if a byte, word, or dword should be compared. Try CMP dword ptr[ebp+arg_0], 1. – Guntram Blohm supports Monica Aug 11 '16 at 15:10
  • tried it and got the same error :/ – QDA Aug 11 '16 at 15:30
  • Is it possible that the compiler doesn't know of value of arg_0 constant ? – w s Aug 11 '16 at 15:54
  • yeah that's true, forgot to change it to CPM [ebp + 8], 1. But the problem is in the next line :( – QDA Aug 11 '16 at 15:55
  • the problem is the "01311723" instead of a label name. – peter ferrie Aug 12 '16 at 16:46
3

Yes 01311723 is a constant and compiler will not know what it is

Neither would compiler know what jmpBackAddy is

for constant you need to replace it with a label and define the label for a label you need to define it in the asm src code

#include <windows.h>
#pragma comment(lib ,"user32.lib")
#pragma comment(lib ,"kernel32.lib")
int CALLBACK WinMain( _In_ HINSTANCE,  _In_opt_ HINSTANCE, _In_ LPSTR, _In_ int)
{
    MessageBoxA(NULL,"Hello World","Hello World",MB_OK);
    jmpBackAddy:   <<< defined here  
    __asm
    {
        CMP [ebp + 8], 1
        JNZ short label
        jmp [jmpBackAddy]
    }    
label:  < defined here 
    MessageBoxA(NULL,"Hello jnz","how are you jnz",MB_OK);
    ExitProcess(0);        
}

compiled and linked with

cl /nologo /Zi /EHsc /O1 /analyze /W4 *.cpp /link /release /entry:WinMain

Msgbox.cpp
e:\test\msgbox\msgbox.cpp(5) : warning C4740: flow in or out of inline asm code suppresses global optimization

and disassembled

Msgbox!WinMain:
00021000 55              push    ebp
00021001 8bec            mov     ebp,esp
00021003 6a00            push    0
00021005 6810200200      push    offset Msgbox!`string' (00022010)
0002100a 6810200200      push    offset Msgbox!`string' (00022010)
0002100f 6a00            push    0
00021011 ff1508200200    call    dword ptr [Msgbox!_imp__MessageBoxA (00022008)]

Msgbox!WinMain+0x17:
00021017 807d0801        cmp     byte ptr [ebp+8],1
0002101b 7502            jne     Msgbox!WinMain+0x1f (0002101f)

Msgbox!WinMain+0x1d:
0002101d ebf8            jmp     Msgbox!WinMain+0x17 (00021017)

Msgbox!WinMain+0x1f:
0002101f 6a00            push    0
00021021 681c200200      push    offset Msgbox!`string' (0002201c)
00021026 682c200200      push    offset Msgbox!`string' (0002202c)
0002102b 6a00            push    0
0002102d ff1508200200    call    dword ptr [Msgbox!_imp__MessageBoxA (00022008)]
00021033 6a00            push    0
00021035 ff1500200200    call    dword ptr [Msgbox!_imp__ExitProcess (00022000)]
0002103b 5d              pop     ebp
0002103c c21000          ret     10h

Not the answer you're looking for? Browse other questions tagged or ask your own question.