CommandLine

flat assembler
Message board for the users of flat assembler.

Index > Windows > CommandLine

Author

Thread

eskizo

Joined: 22 Nov 2005
Posts: 59

eskizo 10 Jul 2009, 14:15

Code:

format PE GUI 4.0
include '%fasminc%\win32a.inc'

section '.code' readable executable

entry $

        call [GetCommandLine]

        push 0
        call [ExitProcess]

section '.idata' readable import

        library kernel32, 'KERNEL32.DLL'
        import kernel32, \
        ExitProcess, 'ExitProcess', \
        GetCommandLine, 'GetCommandLineA'

Everytime GetCommandLine is called, eax returns 00081EE0. I have modified the code many times, and eax still returns 00081EE0. Is it secure to get command line directly from this address?

10 Jul 2009, 14:15

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 10 Jul 2009, 14:19

The GetCommandLineA returns with the address (offset) where system puts the command line for the caller program.

The command line also contains the full path of program!

Example of program with command line:
when you get EAX (offset) form GetCommandLineA you will find:

"C:\windows\system\program.exe" "command line arguments....",0

But you find always the path in EAX return value, also if the program hasn't a command line:

"C:\windows\system\program.exe",0

10 Jul 2009, 14:19

wht36

Joined: 18 Sep 2005
Posts: 106

wht36 11 Jul 2009, 17:24

GetCommandLine does not always return the full program path; for example, if program is ran from cmd.exe then the first argument is exactly what the user specified to call the program.

By the way, mine returns 0008 1EC8, so I don't think you can use a hard coded address.

11 Jul 2009, 17:24

Pirata Derek

Joined: 31 Oct 2008
Posts: 259
Location: Italy

Pirata Derek 13 Jul 2009, 12:06

Oh, yes.
I told it about normal PE GUI

13 Jul 2009, 12:06

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum