; dhae_marker32.asm - NASM / YASM binding of the Dhaedalida RabbitStart/RabbitEnd
; virtualization markers for 32-bit x86 (PE32). The x64 binding is the sibling
; dhae_marker.asm, assembled with -f win64.
;
; NASM could in principle select on __?OUTPUT_FORMAT?__ and keep both bitnesses
; in one file, but you already have to choose `-f win32` vs `-f win64` on the
; command line, and the other two assembler bindings (MASM, FASM) genuinely
; cannot conditionalize - so all three keep the same two-file shape.
;
; 32-bit x86 has no 64-bit immediate, so the magic cannot be hidden inside a
; `mov reg, imm64` the way the x64 binding does. It is emitted as inline DATA
; and jumped over:
;
;     EB 08                       jmp short $+10   -> the ret below
;     01 54 76 DE C0 E5 1A D1     DHAE_SIG_RABBITSTART, little-endian
;     C3                          ret              <- the jump target
;
; The 8 magic bytes therefore sit at offset +2, exactly where the x64 binding
; puts them, well inside the scanner's 16-byte window. The db values MUST equal
; DHAE_SIG_RABBITSTART / DHAE_SIG_RABBITEND in sdk/dhae_marker_sig.h.
;
; The leading underscore is not decoration for its own sake: i386 COFF decorates
; a __cdecl symbol that way, so `_RabbitStart` is the name an MSVC-x86 C caller
; emits. A bare ret is correct because the markers take no arguments - there is
; nothing for a callee-cleanup convention to pop.
;
; Build:
;     nasm -f win32 dhae_marker32.asm -o dhae_marker32.obj     (or yasm -f win32)
; then link dhae_marker32.obj into your PE32 program and declare in C:
;     void RabbitStart(void); void RabbitEnd(void);
; (or just #include "dhae_sdk.h").

bits 32

section .text

global _RabbitStart
global _RabbitEnd
global _BearStart
global _BearEnd

align 16
_RabbitStart:
    db 0xEB, 0x08                                       ; jmp short $+10
    db 0x01, 0x54, 0x76, 0xDE, 0xC0, 0xE5, 0x1A, 0xD1   ; DHAE_SIG_RABBITSTART
    db 0xC3                                             ; ret

align 16
_RabbitEnd:
    db 0xEB, 0x08                                       ; jmp short $+10
    db 0x02, 0x54, 0x76, 0xDE, 0xC0, 0xE5, 0x1A, 0xD1   ; DHAE_SIG_RABBITEND
    db 0xC3                                             ; ret

align 16
_BearStart:
    db 0xEB, 0x08                                       ; jmp short $+10
    db 0x05, 0x54, 0x76, 0xDE, 0xC0, 0xE5, 0x1A, 0xD1   ; DHAE_SIG_BEARSTART
    db 0xC3                                             ; ret

align 16
_BearEnd:
    db 0xEB, 0x08                                       ; jmp short $+10
    db 0x06, 0x54, 0x76, 0xDE, 0xC0, 0xE5, 0x1A, 0xD1   ; DHAE_SIG_BEAREND
    db 0xC3                                             ; ret
