flat assembler
Message board for the users of flat assembler.

Index > Windows > CommandLine

Author
Thread Post new topic Reply to topic
eskizo



Joined: 22 Nov 2005
Posts: 59
eskizo
Code:
format PE GUI 4.0
include '%fasminc%\win32a.inc'

section '.code' readable executable

entry $

        call [GetCommandLine]

        push 0
        call [ExitProcess]

section '.idata' readable import

        library kernel32, 'KERNEL32.DLL'
        import kernel32, \
        ExitProcess, 'ExitProcess', \
        GetCommandLine, 'GetCommandLineA'
    


Everytime GetCommandLine is called, eax returns 00081EE0. I have modified the code many times, and eax still returns 00081EE0. Is it secure to get command line directly from this address?
Post 10 Jul 2009, 14:15
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
The GetCommandLineA returns with the address (offset) where system puts the command line for the caller program.

The command line also contains the full path of program!

Example of program with command line:
when you get EAX (offset) form GetCommandLineA you will find:

"C:\windows\system\program.exe" "command line arguments....",0

But you find always the path in EAX return value, also if the program hasn't a command line:

"C:\windows\system\program.exe",0
Post 10 Jul 2009, 14:19
View user's profile Send private message Send e-mail Reply with quote
wht36



Joined: 18 Sep 2005
Posts: 106
wht36
GetCommandLine does not always return the full program path; for example, if program is ran from cmd.exe then the first argument is exactly what the user specified to call the program.

By the way, mine returns 0008 1EC8, so I don't think you can use a hard coded address.
Post 11 Jul 2009, 17:24
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Oh, yes.
I told it about normal PE GUI
Post 13 Jul 2009, 12:06
View user's profile Send private message Send e-mail Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.