What's the problem here? (ECX clobbered by API calls)

Index > Windows > What's the problem here? (ECX clobbered by API calls)

Author

Thread

rohagymeg

Joined: 19 Aug 2011
Posts: 77

rohagymeg 17 Jan 2012, 00:28

The first one works as expected. ECX stores the pointer of the heap and is decremented because my loop starts with inc ecx and so the first time it needs to be hHeap-1 to start with the first byte of the heap.

Code:

        invoke HeapAlloc, eax, HEAP_ZERO_MEMORY, [config_size]
        mov ebx, eax
        invoke ReadFile, [hFile], eax, [config_size], no_bytes_read, 0
        mov ecx, ebx
        dec ecx

But in the second one, ECX doesn't point to the same location! But I expect it to do the same but with less instructions.

Code:

        invoke HeapAlloc, eax, HEAP_ZERO_MEMORY, [config_size]
        mov ecx, eax
        invoke ReadFile, [hFile], eax, [config_size], no_bytes_read, 0
        dec ecx

So what am I missing?

17 Jan 2012, 00:28

edfed

Joined: 20 Feb 2006
Posts: 4354
Location: Now

edfed 17 Jan 2012, 00:32

maybe ReadFile trash ecx...

17 Jan 2012, 00:32

rohagymeg

Joined: 19 Aug 2011
Posts: 77

rohagymeg 17 Jan 2012, 00:51

Thanks edfed! So how do I know which function does what to which register? Very Happy

17 Jan 2012, 00:51

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 17 Jan 2012, 01:02

Does ReadFile destroy EBX, if so.. then that could be the problem.

Try PUSH EBX / POP EBX

17 Jan 2012, 01:02

Yardman

Joined: 12 Apr 2005
Posts: 244
Location: US

Yardman 17 Jan 2012, 01:20

[ Post removed by author. ]

Last edited by Yardman on 04 Apr 2012, 04:52; edited 1 time in total

17 Jan 2012, 01:20

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 17 Jan 2012, 01:47

Yardman wrote:

There goes typedef talking through his arse again.

Functions (API) preserve all registers, except for eax, ecx, and edx, which can be changed across a function call, and esp, which must be updated according to the calling convention.

Did you make windows ?

17 Jan 2012, 01:47

Tyler

Joined: 19 Nov 2009
Posts: 1216
Location: NC, USA

Tyler 17 Jan 2012, 02:32

typedef wrote:

Yardman wrote:
There goes typedef talking through his arse again.

Functions (API) preserve all registers, except for eax, ecx, and edx, which can be changed across a function call, and esp, which must be updated according to the calling convention.

Did you make windows ?

Is it required to have made Windows to know its calling convention? Look up stdcall. All of Windows' API uses stdcall except for a few (like less than 5) exceptions.

17 Jan 2012, 02:32

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 17 Jan 2012, 02:37

Tyler wrote:

typedef wrote:

Yardman wrote:
There goes typedef talking through his arse again.

Functions (API) preserve all registers, except for eax, ecx, and edx, which can be changed across a function call, and esp, which must be updated according to the calling convention.

Did you make windows ?
Is it required to have made Windows to know its calling convention? Look up stdcall. All of Windows' API uses stdcall except for a few (like less than 5) exceptions.

Is it required to have a Yardie talk shit to you because you uploaded a picture of a false malware alarm on his code ? (http://board.flatassembler.net/topic.php?p=139518#139518)

I don't think so.

17 Jan 2012, 02:37

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20630
Location: In your JS exploiting you and your system

revolution 17 Jan 2012, 04:44

typedef: Read about the standard call convention. What Yardman says is correct. EAX, ECX, EDX and EFLAGS are to be considered clobbered by all API functions all other registers except ESP and EIP are preserved. ESP is updated according to the number of parameters used and EIP is of course set to the following instruction.

17 Jan 2012, 04:44

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 17 Jan 2012, 05:28

However, there is something more simpler to consider, the OP stated that when using EBX to save HeapAlloc result (first code block), it worked, but failed with ECX (second code block), so how it comes that preserving EBX may be needed to solve the problem?? (I believe this is was the main cause for Yardman's reaction, the stdcall thing is of secondary or no importance at all. Personally, I think typedef already knew about both stdcall and that ReadFile adheres to that calling convention.)

17 Jan 2012, 05:28

sinsi

Joined: 10 Aug 2007
Posts: 794
Location: Adelaide

sinsi 17 Jan 2012, 06:40

http://agner.org/optimize/
Look for "5. Calling conventions for different C++ compilers and operating systems"

17 Jan 2012, 06:40

AsmGuru62

Joined: 28 Jan 2004
Posts: 1708
Location: Toronto, Canada

AsmGuru62 17 Jan 2012, 11:35

API preserves EBX,ESI,EDI,ESP,EBP (plus Direction Flag is ALWAYS 0) -- so these can be used to hold stuff between API calls.
The rest of registers may change -- these include EAX,ECX,EDX.

Important!
If user code changes the Direction Flag to one -- it MUST restore it back to 0, otherwise some API will fail.
Windows 'thinks' that DF=0 at all times, so we should keep the same 'thinking' pattern.

Last edited by AsmGuru62 on 17 Jan 2012, 17:43; edited 2 times in total

17 Jan 2012, 11:35

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 17 Jan 2012, 15:05

AsmGuru62, Windows 'thinks' that DF = 0 at all times, (i.e. pointers are incremented, not decremented).
http://msdn.microsoft.com/en-us/library/7td56tzs%28VS.80%29.aspx (Yeah, I know it talks about the C run-time here, but by just inspecting EFLAGS at program entry point, you'll notice DF will also be cleared)

17 Jan 2012, 15:05

AsmGuru62

Joined: 28 Jan 2004
Posts: 1708
Location: Toronto, Canada

AsmGuru62 17 Jan 2012, 17:42

Oh... right! -- DF=0. My bad! I edited my post.

17 Jan 2012, 17:42

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum