BinaryCall UDF - Write Subroutines In C, Call In AutoIt

[Ward]

I have wrote a lot of binary code library for AutoIt before. I also discover many ways to generate binary code for AutoIt in the past. However, all of them have limitation or need some extra effort.

 

Recently, I think I found the best and easiest way to generate the binary code. So I wrote this UDF, may be my last one about binary code.

 

The Features:

• Both AutoIt x86 and x64 version are supported.
• Windows API and static variables can be use (code relocation supported).
• Decompression at run-time with smallest footprint LZMA decoder.
• Allocated memory blocks are released automatically.
• Most C source code works without modification.
• Two step or one step script generation, very easy to use.

How It Works:

1. The C source code must be compiled by MinGW GCC with "-S -masm=intel" option. Output is GAS syntax assembly file.
2. BinaryCall Tool is able to convert the GAS syntax assembly file (*.s) to FASM syntax (*.asm). During the conversion, global symbols will be stored as "Symbol Jump Table" at the head of the file. The output file should be able to be assembled to binary file under command line by FASM.EXE. This syntax conversion is step 1.
3. The step 2 is to assemble the file. BinaryCall Tool will use the embedded FASM to assemble every file twice to generate the relocation table. "BinaryCall.inc" will be included automatically before assembling to detect the Windows API and generate the "API Jump table". All the results will be compressed and converted to AutoIt script output.
4. There are two major functions in the output script. _BinaryCall_Create() function allocates memorys, decompress the binary, relocates the address in memory, and fills the "API Jump Table".
5. _BinaryCall_SymbolList() converts the "Symbol Jump Table" to memory addresses, and then store them as pointers in a DllStruct variable.
6. Finally, we can use DllCallAddress() to call the memory address stored in the DllStruct.

Step by Step Tutorial:

1. Write C source code:

   #include <windows.h>
   void main()
   {
       MessageBox(0, "Hello", "Welcome Message", 1);
   }

2. Use GCC MinGW 32/64 to compile the source code:

   gcc -S -masm=intel -m32 MessageBox.c

3. Use BinaryCall Tool "GAS2AU3 Converter", select "MessageBox.s":

   If Not @AutoItX64 Then
       Local $Code = '...'
       Local $Reloc = '...'
       Local $Symbol[] = ["main"]
   
       Local $CodeBase = _BinaryCall_Create($Code, $Reloc)
       If @Error Then Exit
   
       Local $SymbolList = _BinaryCall_SymbolList($CodeBase, $Symbol)
       If @Error Then Exit
   EndIf

4. Paste the output script, call the main() in AutoIt:

   #Include "BinaryCall.au3"
   
   ; Paste output here
   
   DllCallAddress("none:cdecl", DllStructGetData($SymbolList, "main"))

5. Try to run it!

Change Log:

• v1.0
  • Initial release.
• v1.1
  • A lot of improvement for GAS2ASM converter and FASM header file.
  • Add many C Run-Time library as inline asm subroutines.
  • Add command-line to argc/argv parser for easy calling main() function.
  • Add ability to redirect stdio.

More C source code can work without modification in this version.
Following open source projects are tested.
And Yes, they can run as binary code library in AutoIt now.

SQLite 3.8.5
TCC 0.9.26
PuTTY beta 0.63

• v1.2
  • Dynamic-link library (DLL) calling is supported now. 
    If the C program requires a DLL file to run, just put it together with the source file. BinaryCall Tool will searches *.dll and exports all the symbols in these DLL files automatically. Of course, you need these DLL files when run the output script. However, it also works if you loaded them by last version of MemoryDll UDF.
  • To add more Windows API library easily by editing the ini file.
  • Better error handling and more error messages in output script.
  • Add zero padding to avoid short jumps that crash the relocation table.
  • BinaryCall Tool accepts drag and drop files now.
  • Some small bug fixed.

 

BinaryCall 1.0.zip

BinaryCall 1.1.zip

BinaryCall 1.2.zip

Edited November 23, 2015 by Ward

[JScript]

Very good friend!

JS

[JScript]

A question:

I can build an entire DLL and use in this your system?

JS

[Ward]

This UDF is not for dll. To use dll, you can build dll file and then use it by DllCall, or use MemoryDll UDF.

[DatMCEyeBall]

This is a great tool for improving scripts that rely on complex equations.

Thanks, I might use it over compiling a .dll in some cases

[Ward]

Thanks! In fact, I wrote code relocation generator, GAS To FASM string converter, and memory search routine in AutoIt at first. But I found they had terrible speed for large files. So I rewrote them in C. The embedded FASM, LZMA, and Base64 routines are generated by BinaryCall Tool, too.

[Ward]

BinaryCall UDF and BinaryCall Tool v1.1 are released.

Following open source projects are tested and works in this version.

SQLite 3.8.5

TCC 0.9.26

PuTTY beta 0.63

[FaridAgl]

I searched the zip file for SQLite example but I guess that's not supposed to be there.

I was just thinking about combining this UDF with SQLite UDF, guess it will be much faster.

Also I will be so thankful if you could give a little more explaintion about converting the C source to this, I'm not so familiar with GCC compiler as I always use Microsoft Visual C++, could CodeBlocks be used?

I really like to use this, I want to convert some of my C functions and call them without having to export them in DLLs, but unfortunately I don't have enough knowledge to get this to work.

Thanks in advance.

[Mobius]

This is spectacular Ward damn, your work puts most to shame, thankyou for sharing

[FaridAgl]

I finally managed to use it, seems interesting.

I convert some of my C functions to this and they are just awesome.

The only question I would like to ask is "Which method is faster and of course needs less memory? Using this UDF or exporting the functions in a Dll and using DllCall?"

Thanks Ward, it's a huge work, keep it up.

[Ward]

I am glad to heard it, FaridAgl. It's not hard, right?

I think the speed should be equal to DLL.

Memory usage maybe need some test to say.

However, It has much more fun than DLL.

[FaridAgl]

Yes, the hardest part was compiling the C source using GCC, next steps were simple.

I will run some tests and will post the result.

And of course, it's much more fun than DllCall.

[Andreik]

That's a pretty nice work Ward.

All seems to work well but my symbols have decorated names.

[FaridAgl]

Ward, I run in some problems while trying to convert this function:

expandcollapse popup

#include <windows.h>
#include <iphlpapi.h>
#pragma comment(lib, "iphlpapi.lib")

BOOL IsConnectedToServer(DWORD dwProcessId)
{
    DWORD dwSize = 0;
    if (GetExtendedTcpTable(0, &dwSize, TRUE, AF_INET, TCP_TABLE_OWNER_PID_CONNECTIONS, 0) != ERROR_INSUFFICIENT_BUFFER)
        return FALSE;

    HANDLE hHeap = GetProcessHeap();

    LPVOID lpTcpTable = HeapAlloc(hHeap, 0, dwSize);
    if (lpTcpTable == NULL)
        return FALSE;

    if (GetExtendedTcpTable(lpTcpTable, &dwSize, TRUE, AF_INET, TCP_TABLE_OWNER_PID_CONNECTIONS, 0) != NO_ERROR)
    {
        HeapFree(hHeap, 0, lpTcpTable);
        return FALSE;
    }

    DWORD i;
    MIB_TCPROW_OWNER_PID TcpTable;
    for (i = 0; i < ((PMIB_TCPTABLE_OWNER_PID)lpTcpTable)->dwNumEntries; i++)
    {
        TcpTable = ((PMIB_TCPTABLE_OWNER_PID)lpTcpTable)->table[i];
        if (TcpTable.dwOwningPid == dwProcessId && TcpTable.dwRemotePort == 0xEF21)
        {
            HeapFree(hHeap, 0, lpTcpTable);
            return TRUE;
        }
    }

    HeapFree(hHeap, 0, lpTcpTable);
    return FALSE;
}

I have compiled it using GCC to this:

expandcollapse popup

.file   "Test.c"
    .intel_syntax noprefix
    .text
    .globl  _IsConnectedToServer
    .def    _IsConnectedToServer;   .scl    2;  .type   32; .endef
_IsConnectedToServer:
    push    ebp
    mov ebp, esp
    push    edi
    push    esi
    push    ebx
    sub esp, 92
    mov DWORD PTR [ebp-40], 0
    mov DWORD PTR [esp+20], 0
    mov DWORD PTR [esp+16], 4
    mov DWORD PTR [esp+12], 2
    mov DWORD PTR [esp+8], 1
    lea eax, [ebp-40]
    mov DWORD PTR [esp+4], eax
    mov DWORD PTR [esp], 0
    call    _GetExtendedTcpTable
    cmp eax, 122
    je  L2
    mov eax, 0
    jmp L9
L2:
    call    _GetProcessHeap@0
    mov DWORD PTR [ebp-32], eax
    mov eax, DWORD PTR [ebp-40]
    mov DWORD PTR [esp+8], eax
    mov DWORD PTR [esp+4], 0
    mov eax, DWORD PTR [ebp-32]
    mov DWORD PTR [esp], eax
    call    _HeapAlloc@12
    sub esp, 12
    mov DWORD PTR [ebp-36], eax
    cmp DWORD PTR [ebp-36], 0
    jne L4
    mov eax, 0
    jmp L9
L4:
    mov DWORD PTR [esp+20], 0
    mov DWORD PTR [esp+16], 4
    mov DWORD PTR [esp+12], 2
    mov DWORD PTR [esp+8], 1
    lea eax, [ebp-40]
    mov DWORD PTR [esp+4], eax
    mov eax, DWORD PTR [ebp-36]
    mov DWORD PTR [esp], eax
    call    _GetExtendedTcpTable
    test    eax, eax
    je  L5
    mov eax, DWORD PTR [ebp-36]
    mov DWORD PTR [esp+8], eax
    mov DWORD PTR [esp+4], 0
    mov eax, DWORD PTR [ebp-32]
    mov DWORD PTR [esp], eax
    call    _HeapFree@12
    sub esp, 12
    mov eax, 0
    jmp L9
L5:
    mov DWORD PTR [ebp-28], 0
    jmp L6
L8:
    mov ecx, DWORD PTR [ebp-36]
    mov edx, DWORD PTR [ebp-28]
    mov eax, edx
    sal eax
    add eax, edx
    sal eax, 3
    add eax, ecx
    lea edx, [ebp-64]
    lea ebx, [eax+4]
    mov eax, 6
    mov edi, edx
    mov esi, ebx
    mov ecx, eax
    rep movsd
    mov eax, DWORD PTR [ebp-44]
    cmp eax, DWORD PTR [ebp+8]
    jne L7
    mov eax, DWORD PTR [ebp-48]
    cmp eax, 61217
    jne L7
    mov eax, DWORD PTR [ebp-36]
    mov DWORD PTR [esp+8], eax
    mov DWORD PTR [esp+4], 0
    mov eax, DWORD PTR [ebp-32]
    mov DWORD PTR [esp], eax
    call    _HeapFree@12
    sub esp, 12
    mov eax, 1
    jmp L9
L7:
    inc DWORD PTR [ebp-28]
L6:
    mov eax, DWORD PTR [ebp-36]
    mov eax, DWORD PTR [eax]
    cmp eax, DWORD PTR [ebp-28]
    ja  L8
    mov eax, DWORD PTR [ebp-36]
    mov DWORD PTR [esp+8], eax
    mov DWORD PTR [esp+4], 0
    mov eax, DWORD PTR [ebp-32]
    mov DWORD PTR [esp], eax
    call    _HeapFree@12
    sub esp, 12
    mov eax, 0
L9:
    lea esp, [ebp-12]
    pop ebx
    pop esi
    pop edi
    pop ebp
    ret
    .def    _GetExtendedTcpTable;   .scl    2;  .type   32; .endef
    .def    _GetProcessHeap@0;  .scl    2;  .type   32; .endef
    .def    _HeapAlloc@12;  .scl    2;  .type   32; .endef
    .def    _HeapFree@12;   .scl    2;  .type   32; .endef

But your convertor says:

 

Unresolved external symbol: "_GetExtendedTcpTable"

and fails.

[Ward]

Your code uses "GetExtendedTcpTable" API. 

According to MSDN, it requires "Iphlpapi.dll".

This dll is not declared in BinaryCall.inc by default.

To declare it, add following line to BinaryCall.inc

def_api iphlpapi.dll,10,GetExtendedTcpTable

[FaridAgl]

Thanks Ward, that makes sense and I understood that line.

Just to make it more clear, what is the number "10", in that line?

Edit:

I got it, it's the order you gave them.

Edited July 27, 2014 by FaridAgl

[Ward]

Yes, I already declared following frequency used DLL in BinaryCall.inc (number 1~9).

1. kernel32.dll
2. user32.dll
3. gdi32.dll
4. shell32.dll
5. advapi32.dll
6. comctl32.dll
7. comdlg32.dll
8. wsock32.dll
9. msvcrt.dll

So, if the DLL you used is not here, you must declare it by yourself.

Edited July 28, 2014 by Ward

[Andreik]

I got an error when I tried to make this function to work:

expandcollapse popup

// Credits to matwachich
// http://www.autoitscript.com/forum/topic/150905-need-advise-on-my-wsa-tcp-functions-c/?p=1078769

#define _WIN32_WINNT 0x501
#include <ws2tcpip.h>

int TCPConnect (const char* host, const char* port)
{
    struct addrinfo hints, *result = NULL;
    ZeroMemory(&hints, sizeof(hints));

    hints.ai_family = AF_INET;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;

    if (getaddrinfo(host, port, &hints, &result) != 0) {
        return 0;
    }

    SOCKET ConnectSocket = INVALID_SOCKET;
    ConnectSocket = socket(result->ai_family, result->ai_socktype, result->ai_protocol);
    if (ConnectSocket == INVALID_SOCKET) {
        freeaddrinfo(result);
        return 0;
    }

    if (connect(ConnectSocket, result->ai_addr, (int)result->ai_addrlen) != 0) {
        freeaddrinfo(result);
        return 0;
    }
    freeaddrinfo(result);

    unsigned long mode = 1;
    if (ioctlsocket(ConnectSocket, FIONBIO, &mode) != 0) {
        return 0;
    }

    return ConnectSocket;
}

Using gcc I got this asm file

expandcollapse popup

.file   "prog.cpp"
    .intel_syntax noprefix
    .text
    .globl  __Z10TCPConnectPKcS0_
    .def    __Z10TCPConnectPKcS0_;  .scl    2;  .type   32; .endef
__Z10TCPConnectPKcS0_:
LFB8:
    .cfi_startproc
    .cfi_personality 0,___gxx_personality_v0
    .cfi_lsda 0,LLSDA8
    push    ebp
    .cfi_def_cfa_offset 8
    .cfi_offset 5, -8
    mov ebp, esp
    .cfi_def_cfa_register 5
    sub esp, 72
    mov DWORD PTR [ebp-16], 0
    mov DWORD PTR [esp+8], 32
    mov DWORD PTR [esp+4], 0
    lea eax, [ebp-52]
    mov DWORD PTR [esp], eax
    call    _memset
    mov DWORD PTR [ebp-48], 2
    mov DWORD PTR [ebp-44], 1
    mov DWORD PTR [ebp-40], 6
    lea eax, [ebp-16]
    mov DWORD PTR [esp+12], eax
    lea eax, [ebp-52]
    mov DWORD PTR [esp+8], eax
    mov eax, DWORD PTR [ebp+12]
    mov DWORD PTR [esp+4], eax
    mov eax, DWORD PTR [ebp+8]
    mov DWORD PTR [esp], eax
LEHB0:
    call    _getaddrinfo@16
    sub esp, 16
    test    eax, eax
    setne   al
    test    al, al
    je  L2
    mov eax, 0
    jmp L10
L2:
    mov DWORD PTR [ebp-12], -1
    mov eax, DWORD PTR [ebp-16]
    mov ecx, DWORD PTR [eax+12]
    mov eax, DWORD PTR [ebp-16]
    mov edx, DWORD PTR [eax+8]
    mov eax, DWORD PTR [ebp-16]
    mov eax, DWORD PTR [eax+4]
    mov DWORD PTR [esp+8], ecx
    mov DWORD PTR [esp+4], edx
    mov DWORD PTR [esp], eax
    call    _socket@12
    sub esp, 12
    mov DWORD PTR [ebp-12], eax
    cmp DWORD PTR [ebp-12], -1
    jne L4
    mov eax, DWORD PTR [ebp-16]
    mov DWORD PTR [esp], eax
    call    _freeaddrinfo@4
    sub esp, 4
    mov eax, 0
    jmp L10
L4:
    mov eax, DWORD PTR [ebp-16]
    mov eax, DWORD PTR [eax+16]
    mov edx, eax
    mov eax, DWORD PTR [ebp-16]
    mov eax, DWORD PTR [eax+24]
    mov DWORD PTR [esp+8], edx
    mov DWORD PTR [esp+4], eax
    mov eax, DWORD PTR [ebp-12]
    mov DWORD PTR [esp], eax
    call    _connect@12
    sub esp, 12
    test    eax, eax
    setne   al
    test    al, al
    je  L5
    mov eax, DWORD PTR [ebp-16]
    mov DWORD PTR [esp], eax
    call    _freeaddrinfo@4
    sub esp, 4
    mov eax, 0
    jmp L10
L5:
    mov eax, DWORD PTR [ebp-16]
    mov DWORD PTR [esp], eax
    call    _freeaddrinfo@4
    sub esp, 4
    mov DWORD PTR [ebp-20], 1
    mov eax, 4
    and eax, 127
    sal eax, 16
    or  eax, -2147457410
    lea edx, [ebp-20]
    mov DWORD PTR [esp+8], edx
    mov DWORD PTR [esp+4], eax
    mov eax, DWORD PTR [ebp-12]
    mov DWORD PTR [esp], eax
    call    _ioctlsocket@12
LEHE0:
    sub esp, 12
    test    eax, eax
    setne   al
    test    al, al
    je  L6
    mov eax, 0
    jmp L10
L6:
    mov eax, DWORD PTR [ebp-12]
    jmp L10
L9:
    mov DWORD PTR [esp], eax
LEHB1:
    call    __Unwind_Resume
LEHE1:
L10:
    leave
    .cfi_restore 5
    .cfi_def_cfa 4, 4
    ret
    .cfi_endproc
LFE8:
    .def    ___gxx_personality_v0;  .scl    2;  .type   32; .endef
    .section    .gcc_except_table,"w"
LLSDA8:
    .byte   0xff
    .byte   0xff
    .byte   0x1
    .uleb128 LLSDACSE8-LLSDACSB8
LLSDACSB8:
    .uleb128 LEHB0-LFB8
    .uleb128 LEHE0-LEHB0
    .uleb128 L9-LFB8
    .uleb128 0
    .uleb128 LEHB1-LFB8
    .uleb128 LEHE1-LEHB1
    .uleb128 0
    .uleb128 0
LLSDACSE8:
    .text
    .ident  "GCC: (GNU) 4.8.1"
    .def    _memset;    .scl    2;  .type   32; .endef
    .def    _getaddrinfo@16;    .scl    2;  .type   32; .endef
    .def    _socket@12; .scl    2;  .type   32; .endef
    .def    _freeaddrinfo@4;    .scl    2;  .type   32; .endef
    .def    _connect@12;    .scl    2;  .type   32; .endef
    .def    _ioctlsocket@12;    .scl    2;  .type   32; .endef
    .def    __Unwind_Resume;    .scl    2;  .type   32; .endef

I added manually in BinaryCall.inc this line

def_adr ws2_32.dll,10,getaddrinfo,socket,freeaddrinfo,connect,ioctlsocket

When I use GAS2AU3 Converter I got this error

 

---------------------------
Flat Assembler Error: -108
---------------------------
ILLEGAL_INSTRUCTION

LINE NUMBER: 3048

ERROR LINE: "    .uleb128 LLSDACSE8-LLSDACSB8"

[Ward]

1. Try to use "gcc", not "g++" to compile the source code. (.uleb128 pseudo-op not yet support).
2. You should use "def_api", not "def_adr". They are different.
3. You use "ws2_32.dll", so the line "def_api wsock32.dll" may need be deleted (or add ";" to set as comment)

Edited August 5, 2014 by Ward

[wraithdu]

This is very cool. Can you explain a bit more about the def_api (well, I think I get this one), def_api_ (with the extra _ ), def_adr, and def_label lines in the .inc file?

Edited August 5, 2014 by wraithdu