I don't want to run this without making sure.
In the beingdebugged section, are those hex values ?
I know that in tasm a number is assumed to be a decimal if it doesn't
end in h and a binary value I think ended with a b.
start:
ASSUME FS:nothing
call Custom
invoke ExitProcess,0
Custom proc
PUSH EBP
MOV EBP,ESP
;PUSH ECX
PUSH EAX
PUSH ECX
MOV EAX,DWORD PTR FS:[18]
MOV EAX,DWORD PTR DS:[EAX+30]
MOV ECX,DWORD PTR DS:[EAX]
MOV DWORD PTR SS:[EBP-4],ECX
;POP ECX
POP EAX
MOV EAX,DWORD PTR SS:[EBP-4]
SHR EAX,10
AND EAX,1
;leave
MOV ESP,EBP
POP EBP
BeingDebugged:
mov eax, [fs:0x30]
mov al, [eax + 0x02]
and eax, 0x00000001
ret
Custom endp
0x0001 is hex, but neither Masm nor JWasm understand it.
01h works.