template 1 Kb

Index > Windows > template 1 Kb

Author

Thread

chiacorp

Joined: 16 Oct 2017
Posts: 8

chiacorp 16 Oct 2017, 13:56

Advantages and disadvantages of this template?

Code:

format pe gui 5.0

include 'win32a.inc'

macro xinvoke var,proc,[arg];supplemented macro invoke
 { common
    if ~ arg eq
   reverse
     pushd arg
   common
    end if
    call [proc]
    mov var,eax }  

hinst = $400000

  _sys_class_dlg db '#32770',0
  _title_dlg db 'template 1 Kb',0
  old_proc dd 0
  msg MSG

window_proc:
  mov eax,[esp+8]
  cmp eax,WM_INITDIALOG
  je app_init
  cmp eax,WM_CLOSE
  je app_free

def_window_proc:
  pop eax
  push [old_proc]
  push eax
  jmp [CallWindowProc]

app_init:
  mov eax,[esp+4]
  invoke SendMessage,eax,WM_SETTEXT,0,_title_dlg
  jmp def_window_proc

app_free:
  xor eax,eax
  invoke ExitProcess,eax

entry $
  xor edi,edi
  mov ecx,CW_USEDEFAULT
  xinvoke ebx,CreateWindowEx,edi,_sys_class_dlg,edi,WS_OVERLAPPEDWINDOW+WS_VISIBLE,ecx,ecx,ecx,ecx,edi,edi,hinst,edi
  xinvoke [old_proc],SetWindowLong,ebx,GWL_WNDPROC,window_proc
  invoke SendMessage,ebx,WM_INITDIALOG,edi,edi
  mov ebx,msg
  @@:
  invoke GetMessage,ebx,edi,edi,edi
  cmp eax,1
  jb app_free
  jne @b
  invoke DispatchMessage,ebx
  jmp @b

data import
  library\
    kernel32,'kernel32.dll',\
    user32,'user32.dll'
  include 'api/kernel32.inc'
  include 'api/user32.inc'
end data

Last edited by chiacorp on 16 Oct 2017, 16:21; edited 2 times in total

16 Oct 2017, 13:56

ProMiNick

Joined: 24 Mar 2012
Posts: 804
Location: Russian Federation, Sochi

ProMiNick 16 Oct 2017, 14:35

template should be clear for beginners.
access params throw esp it is good. But in such case params should be commented.

...
pop eax
push [old_proc]
push eax
jmp ...
again stack trickey thing, again it should be commented.

...

in proccessing loop
"jl app_free" will not caught app in endless erorneus cicle like "jb app_free" can.

In your code in app_free in eax passed not error code but always 0, so no needed in xor.
In common case clearing error code returned by process loop is behavior for program that is not "gentleman".

...

macro xinvoke used, but never declared.

...
For Ideas (+used preregistred window class, +good work with stack).
For realization (-absence of comment in trickery places, -loop processing blind to negative msgerrors, -macro xinvoke is a pitty unstandart macro and it not declared in source)

16 Oct 2017, 14:35

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20451
Location: In your JS exploiting you and your system

revolution 16 Oct 2017, 15:00

Some formatting changes would make it easier to read IMO.

Consider aligning all the instructions and operands to their own columns:

Code:

def_window_proc:
        pop     eax
        push    [old_proc]
        push    eax
        jmp     [CallWindowProc]

16 Oct 2017, 15:00

chiacorp

Joined: 16 Oct 2017
Posts: 8

chiacorp 16 Oct 2017, 15:50

Quote:

macro xinvoke used, but never declared.

Thank you ProMiNick!
xinvoke added.

16 Oct 2017, 15:50

chiacorp

Joined: 16 Oct 2017
Posts: 8

chiacorp 16 Oct 2017, 15:56

Quote:

in proccessing loop
"jl app_free" will not caught app in endless erorneus cicle like "jb app_free" can.

works without

Code:

cmp eax,1
jb app_free
jne @b

, but it's going to take longer
this is for deception flat assembler

16 Oct 2017, 15:56

DimonSoft

Joined: 03 Mar 2010
Posts: 1228
Location: Belarus

DimonSoft 16 Oct 2017, 16:42

chiacorp wrote:

Advantages and disadvantages of this template?

Code:

format pe gui 5.0

include 'win32a.inc'

macro xinvoke var,proc,[arg];supplemented macro invoke
 { common
    if ~ arg eq
   reverse
     pushd arg
   common
    end if
    call [proc]
    mov var,eax }  

hinst = $400000

  _sys_class_dlg db '#32770',0
  _title_dlg db 'template 1 Kb',0
  old_proc dd 0
  msg MSG

window_proc:
  mov eax,[esp+8]
  cmp eax,WM_INITDIALOG
  je app_init
  cmp eax,WM_CLOSE
  je app_free

def_window_proc:
  pop eax
  push [old_proc]
  push eax
  jmp [CallWindowProc]

app_init:
  mov eax,[esp+4]
  invoke SendMessage,eax,WM_SETTEXT,0,_title_dlg
  jmp def_window_proc

app_free:
  xor eax,eax
  invoke ExitProcess,eax

entry $
  xor edi,edi
  mov ecx,CW_USEDEFAULT
  xinvoke ebx,CreateWindowEx,edi,_sys_class_dlg,edi,WS_OVERLAPPEDWINDOW+WS_VISIBLE,ecx,ecx,ecx,ecx,edi,edi,hinst,edi
  xinvoke [old_proc],SetWindowLong,ebx,GWL_WNDPROC,window_proc
  invoke SendMessage,ebx,WM_INITDIALOG,edi,edi
  mov ebx,msg
  @@:
  invoke GetMessage,ebx,edi,edi,edi
  cmp eax,1
  jb app_free
  jne @b
  invoke DispatchMessage,ebx
  jmp @b

data import
  library\
    kernel32,'kernel32.dll',\
    user32,'user32.dll'
  include 'api/kernel32.inc'
  include 'api/user32.inc'
end data

Let me add a few more items to the list of code smells.

1. Hardcoding the hinst in such a way is not a good idea, since someone might try to change the ImageBase. You should either use it as a parameter to format directive or determine the HMODULE by calling GetModuleHandle(NULL) at runtime.

2. Jumping directly to ExitProcess from the DialogProc is not a good idea as long as you’re going to grow the template into a real program of a decent size. You dialog may suddenly turn out not to be the only window in your program, you may want to do some stuff after the message loop, etc.

It is bad from the architectural point of view, even in higher-level languages, so why would you want to make it bad in assembly which is more difficult on its own? The only possible reason I could find is size coding, but then again: the xinvoke macro has little to nothing to do with size coding.

3. You are trying to recreate a dialog using plain window functions. This is relying on undocumented behaviour which is a terrible idea. If you need a window that behaves like a dialog, just use a dialog. And if you do, DialogBoxParam lets you avoid the message loop and gets a lot of things done on your behalf while still being quite extensible. Besides, in that case it may even be considered a small step into size coding.

4. Your message loop. If you decide to write it yourself, what removing TranslateMessage call gives you? But we all know what you lose. It’s easier to delete it from a template than to look for a reason keystrokes do not work as expected. And then again, there are other things like accelerators and other stuff.

5. Subclassing. Do you absolutely need subclassing? What’s wrong with dialogs and DialogProc? You can even build dialogs a runtime. No, really, why not just use plain dialogs?

I’d say, a good advice (as well as a program template) comes with rationale. For me, it’s unclear who are the target audience for this template.

P.S. Sorry, if some of my words sound rude. I’m not a native speaker.

16 Oct 2017, 16:42

chiacorp

Joined: 16 Oct 2017
Posts: 8

chiacorp 16 Oct 2017, 17:36

Hello DimonSoft.

Quote:

2. Jumping directly to ExitProcess from the DialogProc is not a good idea as long as you’re going to grow the template into a real program of a decent size. You dialog may suddenly turn out not to be the only window in your program, you may want to do some stuff after the message loop, etc.

This is a conscious step. The application will indeed be one-windowed.

Quote:

3. You are trying to recreate a dialog using plain window functions. This is relying on undocumented behaviour which is a terrible idea. If you need a window that behaves like a dialog, just use a dialog. And if you do, DialogBoxParam lets you avoid the message loop and gets a lot of things done on your behalf while still being quite extensible. Besides, in that case it may even be considered a small step into size coding.

Resources in the application are missing.
DialogBoxParam creates from a template in resources or memory.
CreateWindowEx will be used to create child window elements.

Quote:

4. Your message loop. If you decide to write it yourself, what removing TranslateMessage call gives you? But we all know what you lose. It’s easier to delete it from a template than to look for a reason keystrokes do not work as expected. And then again, there are other things like accelerators and other stuff.

The features that give this function will be implemented in the code.

Quote:

P.S. Sorry, if some of my words sound rude. I’m not a native speaker.

Thank you DimonSoft.

16 Oct 2017, 17:36

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum