Thread: Win32 API

The main difference between DOS and Windozy coding, is that you don't have
Interrupts to use anymore. Windozy tells the low-level programmer to ****
off, you now have to *LINK* the functions you want, no more "Do this now!"
oh no, you have to *ASK* the ****ing OS to let you do it. Let's face it,
it's a pile of shit, but none-the-less, we have to get used to it!

The closest you could get to DOS in Win32 ASM is by hitting the VxD Calls
this is okay, apart from the fact the calls are quite undocumented (but you
can find the information about) and I've noticed some debugger's won't
debug any program which does not import ANY API's! SUCKS!

So, how the hell do we use these API's? First we have to let our compiler
and linker know what API functions we want... So in your ASM module, you
would require some code such as...

Code:

Extrn   <API Name>:PROC

The API name *IS* Case Sensitive!!!! eg. ExitProcess <> EXITPROCESS
So for example, to include the ExitProcess function into your ASM prog. you
will need the following line

Code:

Extrn   ExitProcess:PROC

So, you've learnt how to define your API's! So, now you want to be able to
use them! Well, that's easy!
For this example, we'll use GetProcAddress, as it has parameters, a return
value, and the two params are of diffent types...

From your API source --

Code:

   FARPROC      GetProcAddress (
        HMODULE hModule                 // Handle to DLL Module
        LPCSTR  lpProcName              // Address of function
   );

So what are all those words? Let's snap it down

Code:

 FARPROC - The type of return value, in this case it is a DWORD
           containing the address of the Procedure!
 HMODULE - A *VALUE*, which is the handle to the DLL!
 LPCSTR  - A *POINTER* to an ASCIIZ string!

So in code, you call, with your parameters, and the output value is
returned to you in EAX.
Fine, but what about calling with the parameters? Well, depending on which
compiler your using, the syntax is slightly different, although there is a
global way.

Code:

 MASM has a function called INVOKE
   INVOKE       <API Name>,<Param 1>,<Param 2>.....<Param n>
 TASM has an extended call
   CALL         <API Name>,<Param 1>,<Param 2>.....<Param n>
 Global coding method
   PUSH         <Param n>
    :               :
   PUSH         <Param 2>
   PUSH         <Param 1>
   CALL         <API Name>

So, lets test out the API..

        .386
        .model flat

Extrn   GetProcAddress:PROC

Kern    equ     0BFF70000h      ;<- Win9x Kernel handle

        .data
xIt     db      'ExitProcess',0

        .code
start:  push    offset xIt      ;<- Push POINTER of xIt
        push    Kern            ;<- Kern Module handle
        call    GetProcAddress  ;<- Call API

        push    eax             ;<- EAX holds address of ExitProcess
        ret                     ;<- Exit Program! :)

        end start

From what you've read, this means all API's has to be linked. However, you
can't have them linked to a virus, unless you're a spawning virus or
companion! So that's why we have GetProcAddress! If you can get access to
this function, you can use it to get the address' of the API you need, and
call them. If you don't expect to return (eg. ExitProcess) then you can
code like in the example above where you push the address (EAX) and
"Return", otherwise you need to CALL it!

Code:

        .386
        .model flat

Extrn   GetProcAddress:PROC

Kern    equ     0BFF70000h      ;<- Win9x Kernel handle

        .data
Usr     db      'USER32',0
GetMod  db      'GetModuleHandleA',0
xIt     db      'ExitProcess',0

        .code
start:  push    offset GetMod   ;<- Push POINTER to GetModHand
        push    Kern            ;<- Kern Module handle
        call    GetProcAddress  :<- Call API

        xchg    edi,eax         ;<- Put API address into EDI

; DWORD GetModuleHandleA(LPCSTR lpModuleName);
        push    offset Usr      ;<- Pointer to USER32 ASCIIZ string
        call    [edi]           ;<- Call API address

;Here, EAX = Handle of User32, EDI = Address of GetModuleHandleA

        push    offset xIt      ;<- Push POINTER of xIt
        push    Kern            ;<- Kern Module handle
        call    GetProcAddress  ;<- Call API

        push    eax             ;<- EAX holds address of ExitProcess
        ret                     ;<- Exit Program! :)

        end start

By Rat Heart /ASM