; dhae_marker.asm - Dhaedalida RabbitStart / RabbitEnd virtualization markers for MASM
; (ml64, x86-64).
;
; Each marker is a tiny leaf that emits `movabs rax, <magic>` (ml64 encodes the
; 64-bit immediate as 48 B8 + 8 little-endian bytes) followed by `ret`, so the 8
; magic bytes land in .text and the Dhaedalida GUI detects a caller exactly like
; the C binding (see sdk/dhae_marker_sig.h). The immediates below MUST equal
; DHAE_SIG_RABBITSTART / DHAE_SIG_RABBITEND there.
;
; Assemble and link into your PE32+ x64 program:
;     ml64 /c /Fo dhae_marker.obj dhae_marker.asm
; Call RabbitStart / RabbitEnd (undecorated on x64) around the code you want protected.

.code

ALIGN 16
PUBLIC RabbitStart
RabbitStart PROC
    mov   rax, 0D11AE5C0DE765401h        ; movabs rax, magic   (48 B8 01 54 76 DE C0 E5 1A D1)
    ret
RabbitStart ENDP

ALIGN 16
PUBLIC RabbitEnd
RabbitEnd PROC
    mov   rax, 0D11AE5C0DE765402h        ; movabs rax, magic   (48 B8 02 54 76 DE C0 E5 1A D1)
    ret
RabbitEnd ENDP

ALIGN 16
PUBLIC BearStart
BearStart PROC
    mov   rax, 0D11AE5C0DE765405h        ; movabs rax, magic   (48 B8 05 54 76 DE C0 E5 1A D1)
    ret
BearStart ENDP

ALIGN 16
PUBLIC BearEnd
BearEnd PROC
    mov   rax, 0D11AE5C0DE765406h        ; movabs rax, magic   (48 B8 06 54 76 DE C0 E5 1A D1)
    ret
BearEnd ENDP

END
