2 ; Copyright (C) 2007 Tomas 'ZeXx86' Jedrzejek (zexx86@gmail.com)
4 ; This program is free software: you can redistribute it and/or modify
5 ; it under the terms of the GNU General Public License as published by
6 ; the Free Software Foundation, either version 3 of the License, or
7 ; (at your option) any later version.
9 ; This program is distributed in the hope that it will be useful,
10 ; but WITHOUT ANY WARRANTY; without even the implied warranty of
11 ; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 ; GNU General Public License for more details.
14 ; You should have received a copy of the GNU General Public License
15 ; along with this program. If not, see <http://www.gnu.org/licenses/>.
40 mov [0 + ebx],edi ; buf->edi == 0(ebx) == EDI
41 mov [4 + ebx],esi ; buf->esi == 4(ebx) == ESI
42 mov [8 + ebx],ebp ; buf->ebp == 8(ebx) == EBP
44 mov [20 + ebx],edx ; buf->edx == 20(ebx) == EDX
45 mov [24 + ebx],ecx ; buf->ecx == 24(ebx) == ECX
46 mov [28 + ebx],eax ; buf->eax == 28(ebx) == EAX
48 ; use EBX value saved on stack; not the current value
50 mov [16 + ebx],eax ; buf->ebx == 16(ebx) == EBX
52 ; use ESP value after RET; not the current value
54 mov [12 + ebx],eax ; buf->esp == 32(ebx) == ESP
56 ; use return address of this routine (EIP value saved on stack);
57 ; not the current value
59 mov [32 + ebx],eax ; buf->eip == 36(ebx) == EIP
61 ; none of the PUSH or MOV instructions changed EFLAGS!
63 pop dword [36 + ebx] ; buf->eflags == 40(ebx) == EFLAGS