Function definition

Index > Windows > Function definition

Author

Thread

Lucy Berie

Joined: 08 Dec 2012
Posts: 13

Lucy Berie 09 Dec 2012, 13:10

Hi!

From the invoke macro, I've sucessfully implemented 'terminating a process' by assembly code. Here is my code :

Code:

;explorer.exe
PID = 1528
...................................
invoke TerminateProcess, invoke OpenProcess, 1, 0, PID, 0

Now, I want to get the process Id via a function. I want to translate :

Code:

int ProcessId()
{
return 1352;
}
.................................
invoke TerminateProcess, invoke OpenProcess, 1, 0, call ProcessId...

To assembly code...
Thanks you. Very Happy

Last edited by Lucy Berie on 09 Dec 2012, 13:17; edited 1 time in total

09 Dec 2012, 13:10

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20430
Location: In your JS exploiting you and your system

revolution 09 Dec 2012, 13:17

You can also use the simpler:

Code:

invoke ExitProcess,0

Edit: Perhaps I misunderstood what you want.

You would usually use stdcall or ccall instead of invoke for internal function calls.

09 Dec 2012, 13:17

Lucy Berie

Joined: 08 Dec 2012
Posts: 13

Lucy Berie 09 Dec 2012, 13:50

Thanks.
My question is : How to define a function?
Could you give me a function template example, which has an integer returning value (Like the simple C function example I mentioned above...)

09 Dec 2012, 13:50

ManOfSteel

Joined: 02 Feb 2005
Posts: 1154

ManOfSteel 09 Dec 2012, 15:14

C functions are nothing more than subroutines being called with their parameters pushed on the stack.

The proc macroinstruction provides a method to define procedures, e.g.:

Code:

mov eax,1234

; call "TestProc" procedure with a parameter of "1234"
stdcall TestProc,eax


[...]
[some more code]
[...]


; define "TestProc" procedure
proc TestProc Parameter
; define a local variable called "LOCAL_VAR"
local LOCAL_VAR:DWORD

; read the local variable
lea ebx,[LOCAL_VAR]

; write to the local variable
mov [LOCAL_VAR],0xABCD

; invoke a system API that uses the contents of "Parameter", i.e. "1234" in decimal
invoke SomeSystemAPI,[Parameter],ecx,0xDEADBEEF

ret
endp

Check the Windows programming headers for more information.

09 Dec 2012, 15:14

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum