Winapi will affect register?

Index > Windows > Winapi will affect register?

Author

Thread

eskizo

Joined: 22 Nov 2005
Posts: 59

eskizo 01 Jul 2009, 13:52

Hello!

Code:

mov ecx, 0x00FF
here:
invoke MessageBox, 0, 0, 0, MB_OK
loop here

This generates an infinite loop, becouse MessageBox changes ecx value. How to know what registers will be changed by winapi functions?

01 Jul 2009, 13:52

Picnic

Joined: 05 May 2007
Posts: 1404
Location: Piraeus, Greece

Picnic 01 Jul 2009, 14:04

EAX, ECX, and EDX are not preserved.

01 Jul 2009, 14:04

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 01 Jul 2009, 14:05

Look up the calling conventions. WinAPI uses stdcall.

StdCall affects the following registers: eax ecx edx. Do NOT rely on the value of these registers on return!

01 Jul 2009, 14:05

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 01 Jul 2009, 14:37

I found some APIs that change also the EBX and/or ESI and/or EDI
it depends if the called API procedure push EBX,ESI and EDI (or any other registers) and after pop them.

Pushing registers before calling the api is better!
simple example:

Code:

mov ecx,5
@@: push ecx
invoke MessageBoxA,0,text,title,MB_OK
pop ecx
loopd @B

more complex Example:

Code:

push 0 ; exit code
mov ecx,5
@@: push ecx
invoke MessageBoxA,0,text,title,MB_OK
pop ecx
cmp eax,FALSE
je @F
loopd @B
@@: invoke ExitProcess

Last edited by Pirata Derek on 01 Jul 2009, 14:43; edited 1 time in total

01 Jul 2009, 14:37

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 01 Jul 2009, 14:42

It depends on the calling convention. Stdcall always preserves EBX, ESI, EDI, and EBP.

Pirata Derek wrote:

Pushing registers before calling the api is better!

there goes optimization down the toilet Wink

_________________
Previously known as The_Grey_Beast

01 Jul 2009, 14:42

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 01 Jul 2009, 14:44

Quote:

I found some APIs that change also the EBX and/or ESI and/or EDI
it depends if the called API procedure push EBX,ESI and EDI and after pop them.

Pushing registers before calling the api is better!

I had this problem once on Win98SE, but after trying reproducing it years later I couldn't. What could be happening here actually is that you have a virus. In my case was some of the windows enumeration functions which probably the virus hooked to hide itself more.

01 Jul 2009, 14:44

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 01 Jul 2009, 15:01

Download the program below and tell me the response...

you can modify the STDCALL,

but you will see that is the PROC to modify the EBX, ESI, and EDI,
not the STDCALL...

Razz

Description:	TEST THIS PROGRAM!	Download
Filename:	Process that not preserve.zip
Filesize:	106.32 KB
Downloaded:	382 Time(s)

01 Jul 2009, 15:01

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 01 Jul 2009, 15:10

But PROCEDURA is not part of the Windows API Razz

[edit]Found the thread: http://board.flatassembler.net/topic.php?t=8006

01 Jul 2009, 15:10

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 02 Jul 2009, 10:54

If you, LocoDelAssembly, put more attention on these topics (reading all the conversation) you will read that i contested the Borsuc's last topic on:

"Stdcall always preserves EBX, ESI, EDI, and EBP. "

PROCEDURA is a proc that always return with EBX,ESI and EDI modified after any STDCALL or INVOKE calls.
It's an example to invalidate borsuc's answer.

¿Tengo que escribirte en español?

TRANQUILO, NO TENGO VIRUS!

02 Jul 2009, 10:54

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 02 Jul 2009, 15:41

I don't get your point.
PROCEDURA is not a stdcall function. It does not comply to the standards set.

Stdcall is not just the call. The procedure must follow the standards for it to be stdcall, not just the caller of the function.

02 Jul 2009, 15:41

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 02 Jul 2009, 16:42

Here's what stdcall says:

Arguments are pushed on the stack, from right to left
If the function has a return value, it should be in eax.
If the function uses ebx, it must PUSH it (in the FUNCTION) and POP it before returning
If the function uses esi, it must PUSH it (in the FUNCTION) and POP it before returning
If the function uses edi, it must PUSH it (in the FUNCTION) and POP it before returning
If the function uses ebp, it must PUSH it (in the FUNCTION) and POP it before returning

If you do not qualify for all conditions, your function isn't stdcall. There's nothing wrong with not being stdcall (heck that's why asm is flexible), but the WinAPI is all stdcall, so every function qualifies for all conditions.

_________________
Previously known as The_Grey_Beast

02 Jul 2009, 16:42

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 03 Jul 2009, 10:33

So you forgot what i've posted?

"it depends if the called API procedure push EBX,ESI and EDI (or any other registers) and after pop them. "

Is it like your last post (upper) ?
if yes, why do you reply with THIS?

have you disasembled ALL WinAPIs?
Remember that all WinAPIs aren't equals

I'll post you a list of not STDCALL STANDARD WINAPI (referenced by you last post)
Wait... the APIs are too much. Sad

03 Jul 2009, 10:33

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 03 Jul 2009, 12:50

No, you push them in the FUNCTION, not when you CALL it.

Example of proper stdcall.

Code:

; code
push 1
push 2
call function

...


;
; FUNCTION
;
function:
push ebx
mov ebx, [esp+8]
mov ecx, [esp+4]

...

pop ebx
retn 2*4

@Pirata Derek: however, you seem like a guy who is interested in Windows details (with the kernel dispatcher and all that), so if you do find a Windows API that is officially "stdcall" (check MSDN website for info), and does not follow it, then you have found a bug and it would be cool if you posted it Smile

Last edited by Borsuc on 04 Jul 2009, 01:51; edited 1 time in total

03 Jul 2009, 12:50

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 03 Jul 2009, 13:54

It's a good idea Exclamation

03 Jul 2009, 13:54

eskizo

Joined: 22 Nov 2005
Posts: 59

eskizo 03 Jul 2009, 14:19

thankyou for these precious descriptions.

03 Jul 2009, 14:19

Picnic

Joined: 05 May 2007
Posts: 1404
Location: Piraeus, Greece

Picnic 03 Jul 2009, 16:01

Borsuc, shouldn't be ?

Code:

retn 8

03 Jul 2009, 16:01

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 04 Jul 2009, 01:51

thimis wrote:

Borsuc, shouldn't be ?
Code:
retn 8
    

Right!

My bad. I was in a rush when I posted that. Smile

_________________
Previously known as The_Grey_Beast

04 Jul 2009, 01:51

Picnic

Joined: 05 May 2007
Posts: 1404
Location: Piraeus, Greece

Picnic 04 Jul 2009, 18:33

Yes i though so. Razz

04 Jul 2009, 18:33

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum