flat assembler
Message board for the users of flat assembler.

Index > Windows > Winapi will affect register?

Author
Thread Post new topic Reply to topic
eskizo



Joined: 22 Nov 2005
Posts: 59
eskizo
Hello!

Code:
mov ecx, 0x00FF
here:
invoke MessageBox, 0, 0, 0, MB_OK
loop here    


This generates an infinite loop, becouse MessageBox changes ecx value. How to know what registers will be changed by winapi functions?
Post 01 Jul 2009, 13:52
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1288
Location: behind the arc
Picnic
EAX, ECX, and EDX are not preserved.
Post 01 Jul 2009, 14:04
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Look up the calling conventions. WinAPI uses stdcall.

StdCall affects the following registers: eax ecx edx. Do NOT rely on the value of these registers on return!
Post 01 Jul 2009, 14:05
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I found some APIs that change also the EBX and/or ESI and/or EDI
it depends if the called API procedure push EBX,ESI and EDI (or any other registers) and after pop them.

Pushing registers before calling the api is better!
simple example:
Code:
mov ecx,5
@@: push ecx
invoke MessageBoxA,0,text,title,MB_OK
pop ecx
loopd @B    


more complex Example:
Code:
push 0 ; exit code
mov ecx,5
@@: push ecx
invoke MessageBoxA,0,text,title,MB_OK
pop ecx
cmp eax,FALSE
je @F
loopd @B
@@: invoke ExitProcess    


Last edited by Pirata Derek on 01 Jul 2009, 14:43; edited 1 time in total
Post 01 Jul 2009, 14:37
View user's profile Send private message Send e-mail Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
It depends on the calling convention. Stdcall always preserves EBX, ESI, EDI, and EBP.

Pirata Derek wrote:
Pushing registers before calling the api is better!
there goes optimization down the toilet Wink

_________________
Previously known as The_Grey_Beast
Post 01 Jul 2009, 14:42
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
Quote:

I found some APIs that change also the EBX and/or ESI and/or EDI
it depends if the called API procedure push EBX,ESI and EDI and after pop them.

Pushing registers before calling the api is better!

I had this problem once on Win98SE, but after trying reproducing it years later I couldn't. What could be happening here actually is that you have a virus. In my case was some of the windows enumeration functions which probably the virus hooked to hide itself more.
Post 01 Jul 2009, 14:44
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Download the program below and tell me the response...

you can modify the STDCALL,

but you will see that is the PROC to modify the EBX, ESI, and EDI,
not the STDCALL...


Razz Razz Razz Razz Razz Razz


Description: TEST THIS PROGRAM!
Download
Filename: Process that not preserve.zip
Filesize: 106.32 KB
Downloaded: 109 Time(s)

Post 01 Jul 2009, 15:01
View user's profile Send private message Send e-mail Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
But PROCEDURA is not part of the Windows API Razz
[edit]Found the thread: http://board.flatassembler.net/topic.php?t=8006
Post 01 Jul 2009, 15:10
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
If you, LocoDelAssembly, put more attention on these topics (reading all the conversation) you will read that i contested the Borsuc's last topic on:

"Stdcall always preserves EBX, ESI, EDI, and EBP. "

PROCEDURA is a proc that always return with EBX,ESI and EDI modified after any STDCALL or INVOKE calls.
It's an example to invalidate borsuc's answer.

¿Tengo que escribirte en español?

TRANQUILO, NO TENGO VIRUS!
Post 02 Jul 2009, 10:54
View user's profile Send private message Send e-mail Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
I don't get your point.
PROCEDURA is not a stdcall function. It does not comply to the standards set.

Stdcall is not just the call. The procedure must follow the standards for it to be stdcall, not just the caller of the function.
Post 02 Jul 2009, 15:41
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Here's what stdcall says:

  • Arguments are pushed on the stack, from right to left
  • If the function has a return value, it should be in eax.
  • If the function uses ebx, it must PUSH it (in the FUNCTION) and POP it before returning
  • If the function uses esi, it must PUSH it (in the FUNCTION) and POP it before returning
  • If the function uses edi, it must PUSH it (in the FUNCTION) and POP it before returning
  • If the function uses ebp, it must PUSH it (in the FUNCTION) and POP it before returning


If you do not qualify for all conditions, your function isn't stdcall. There's nothing wrong with not being stdcall (heck that's why asm is flexible), but the WinAPI is all stdcall, so every function qualifies for all conditions.

_________________
Previously known as The_Grey_Beast
Post 02 Jul 2009, 16:42
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
So you forgot what i've posted?

"it depends if the called API procedure push EBX,ESI and EDI (or any other registers) and after pop them. "

Is it like your last post (upper) ?
if yes, why do you reply with THIS?

have you disasembled ALL WinAPIs?
Remember that all WinAPIs aren't equals

I'll post you a list of not STDCALL STANDARD WINAPI (referenced by you last post)
Wait... the APIs are too much. Sad
Post 03 Jul 2009, 10:33
View user's profile Send private message Send e-mail Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
No, you push them in the FUNCTION, not when you CALL it.

Example of proper stdcall.
Code:
; code
push 1
push 2
call function

...


;
; FUNCTION
;
function:
push ebx
mov ebx, [esp+8]
mov ecx, [esp+4]

...

pop ebx
retn 2*4    


@Pirata Derek: however, you seem like a guy who is interested in Windows details (with the kernel dispatcher and all that), so if you do find a Windows API that is officially "stdcall" (check MSDN website for info), and does not follow it, then you have found a bug and it would be cool if you posted it Smile


Last edited by Borsuc on 04 Jul 2009, 01:51; edited 1 time in total
Post 03 Jul 2009, 12:50
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
It's a good idea Exclamation
Post 03 Jul 2009, 13:54
View user's profile Send private message Send e-mail Reply with quote
eskizo



Joined: 22 Nov 2005
Posts: 59
eskizo
thankyou for these precious descriptions.
Post 03 Jul 2009, 14:19
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1288
Location: behind the arc
Picnic
Borsuc, shouldn't be ?
Code:
retn 8
    
Post 03 Jul 2009, 16:01
View user's profile Send private message Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
thimis wrote:
Borsuc, shouldn't be ?
Code:
retn 8
    
Right! Embarassed
My bad. I was in a rush when I posted that. Smile

_________________
Previously known as The_Grey_Beast
Post 04 Jul 2009, 01:51
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1288
Location: behind the arc
Picnic
Yes i though so. Razz
Post 04 Jul 2009, 18:33
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.