; dhae_marker.asm - Dhaedalida RabbitStart / RabbitEnd virtualization markers for FASM
; (flat assembler, x86-64).
;
; Assembled to an MS COFF64 object you link into your PE32+ x64 program. Each
; marker emits `movabs rax, <magic>; ret` (FASM encodes the 64-bit immediate as
; 48 B8 + 8 little-endian bytes), so the 8 magic bytes land in .text and the
; Dhaedalida GUI detects a caller exactly like the C binding
; (see sdk/dhae_marker_sig.h). The immediates below MUST equal DHAE_SIG_RABBITSTART /
; DHAE_SIG_RABBITEND there.
;
; Assemble:  fasm dhae_marker.asm dhae_marker.obj
; then link dhae_marker.obj into your program and call RabbitStart / RabbitEnd around the
; code you want protected. (For a whole FASM-built PE, drop the two labels into
; your own `.text` and `public` them instead.)

format MS64 COFF

section '.text' code readable executable

public RabbitStart
public RabbitEnd
public BearStart
public BearEnd

RabbitStart:
    mov rax, 0D11AE5C0DE765401h          ; movabs rax, magic   (48 B8 01 54 76 DE C0 E5 1A D1)
    ret

RabbitEnd:
    mov rax, 0D11AE5C0DE765402h          ; movabs rax, magic   (48 B8 02 54 76 DE C0 E5 1A D1)
    ret

BearStart:
    mov rax, 0D11AE5C0DE765405h          ; movabs rax, magic   (48 B8 05 54 76 DE C0 E5 1A D1)
    ret

BearEnd:
    mov rax, 0D11AE5C0DE765406h          ; movabs rax, magic   (48 B8 06 54 76 DE C0 E5 1A D1)
    ret
