CommandLineToArgvW test / PE brewing

Index > Main > CommandLineToArgvW test / PE brewing

Author

Thread

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 27 Nov 2009, 07:07

Note: this is deliberately posted in Main since related to both DOS and Win32.

Note to Edfed & Co : this doesn't work in Windaube 98 & Co (see shot below) Laughing

Code:

        pope   eax            ; Our silly "PO-inter" | Now stack is neutral
        pushd  0              ; Reserved UINT32 for output
        mov    ecx, esp       ; Now points to the reserved UINT32
        push   ecx            ; Output: number of args captured 
        push   eax            ; Input PO-inter
        call   dword [CommandLineToArgvW]   ; Result PO-inter in EAX
        push   eax            ; PO-inter is at [ESP] | Amount is at [ESP+4]

Download now (37 KiB) : id=4673 Smile

Purposes of the thing:

- PE brewing example

- Win32 console example

- GetCommandlineAW & CommandLineToArgvW usage example

- Preparing future CommandLineToArgvW implementation in DOS Shocked

UPDATED 2013-Apr-10

Last edited by DOS386 on 10 Apr 2013, 13:12; edited 3 times in total

27 Nov 2009, 07:07

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 30 Nov 2009, 06:40

2 more shots are available exclusively inside the archive Smile

30 Nov 2009, 06:40

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 30 Nov 2009, 19:43

pope?

_________________
Previously known as The_Grey_Beast

30 Nov 2009, 19:43

f0dder

Joined: 19 Feb 2004
Posts: 3175
Location: Denmark

f0dder 30 Nov 2009, 21:26

Ugh. My eyes are bleeding after looking at that code.

30 Nov 2009, 21:26

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid 30 Nov 2009, 21:53

Yeah. Looks so... custom. What's wrong with printf again?

30 Nov 2009, 21:53

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 01 Dec 2009, 03:47

Code isn't that bad, but I still don't get what's with the pope Smile

_________________
Previously known as The_Grey_Beast

01 Dec 2009, 03:47

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 01 Dec 2009, 14:05

> What's wrong with printf again?

Instead of what instruction ?

01 Dec 2009, 14:05

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 10 Apr 2013, 13:15

UPDATED - added PString example as competition against CommandLineToArgvW Shocked

Code:

        ; We can try to copy it (may be terminated by space or ZERO !!!)

        mov    ch, 0                ; Single arg size
arg_copy_loop:
        cmp    ch, ccsngarglim      ; Check single arg size limit
        jae    short parse_abort    ; Bad luck 
        mov    ah, dl               ; DL already validated dest size
        add    ah, ch               ; CH incomplete source and dest raw size
        cmp    ah, (ccoutbufsiz-3)  ; Reserv 3 Byte's | Const limit 61 to 252
        jae    short parse_abort    ; Bad luck 
        cmp    al, 32
        jb     short patch_dot
        cmp    al, 127              ; "~" + 1
        jb     short no_patch_dot
patch_dot:
        mov    al, 46               ; Dot "."
no_patch_dot:
        inc    edi                  ; & Place char to [EDI+1]
        stosb                       ; & After this EDI will point
        dec    edi                  ; & to the char
        inc    ch                   ; Single arg size
        cmp    dh, 240
        ja     short parse_abort    ; OK, this was the hard source limit
        mov    al, [esi]            ; Do NOT use LODSB !!!
        and    al, 223              ; Test for 32 and ZERO | 255 - 32 = 223
        jz     short copied_him_wow ; We DID NOT inc, "arg_space_loop" will
        lodsb
        inc    dh                   ; Source commandline string size
        jmp    short arg_copy_loop
        ;-------------------------

Please download it again (the old files are still in and unchanged)

http://board.flatassembler.net/download.php?id=4673

10 Apr 2013, 13:15

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 10 Apr 2013, 22:32

DOS386,

If CommandLineToArgvW() is stdcall (as it looks like), mov ecx, esp / push ecx can be replaced with simple push esp, isn't it?

10 Apr 2013, 22:32

KevinN

Joined: 09 Oct 2012
Posts: 160

KevinN 11 Apr 2013, 00:36

cool

11 Apr 2013, 00:36

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 13 Apr 2013, 06:58

> If CommandLineToArgvW() is stdcall (as it looks like),
> mov ecx, esp / push ecx can be replaced with simple push esp

Maybe true ... maybe PUSH ESP was dangerous ... or did this problem exist on 8086 with PUSH SP only ?

BTW, was anyone (Revolution ?) able to "break" my "TESTCMPS.EXE" - make it crash or produce garbage or corrupt memory ?

13 Apr 2013, 06:58

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20449
Location: In your JS exploiting you and your system

revolution 13 Apr 2013, 11:34

DOS386 wrote:

BTW, was anyone (Revolution ?) able to "break" my "TESTCMPS.EXE" - make it crash or produce garbage or corrupt memory ?

Not me. I don't even know what you are asking about, but if it runs under DOS then I won't be able to test it.

13 Apr 2013, 11:34

ACP

Joined: 23 Sep 2006
Posts: 204

ACP 13 Apr 2013, 20:37

DOS386 wrote:

Maybe true ... maybe PUSH ESP was dangerous ... or did this problem exist on 8086 with PUSH SP only ?

Are you referring to the fact that push (e)sp works differently on >=386 than on 8086 or do you mean something else?

13 Apr 2013, 20:37

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 15 Apr 2013, 13:55

> Are you referring to the fact that push (e)sp works
> differently on >=386 than on 8086

YES. The idea of "PUSH SP" or ESP or RSP or ISP (Insane Stack Pointer - 1024 bits wide on XXXX1024 CPU's available soon) is somewhat strange to me, but there apparently exists at least one piece of code that can use it Smile

> but if it runs under DOS then I won't be able to test it

It runs also in DOS.

15 Apr 2013, 13:55

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum