26278 total geeks with 3498 solutions
Recent challengers:
 Welcome, you are an anonymous user! [register] [login] Get a yourname@osix.net email address 

Articles

GEEK

User's box
Username:
Password:

Forgot password?
New account

Shoutbox
MaxMouse
It's Friday... That's good enough for me!
CodeX
non stop lolz here but thats soon to end thanks to uni, surely the rest of the world is going good?
stabat
how things are going guys? Here... boring...
CodeX
I must be going wrong on the password lengths then, as long as it was done on ECB
MaxMouse
lol... the key is in hex (MD5: of the string "doit" without the "'s) and is in lower case. Maybe i should have submitted this as a challenge!

Donate
Donate and help us fund new challenges
Donate!
Due Date: May 31
May Goal: $40.00
Gross: $0.00
Net Balance: $0.00
Left to go: $40.00
Contributors


News Feeds
The Register
EMC vuln gives mere
sysadmins the power
of storage admins
Four Anons cuffed
in Italy
IBM gives a cloudy
outlook for COBOL
Bureau of Stats
releases
educational
SimClone game
I know who "Satoshi
Nakamoto" is, says
Ted Nelson
Google builds
crowdsourcing into
new Maps code stack
Google"s Native
Code browser tech
goes cross-platform
Yahoo! to "share
something special"
in New York on
Monday
Adobe"s Creative
Cloud fails at
being a cloud
NASA signs off on
sampling mission to
Earth-threatening
asteroid
Slashdot
Military Dolphins
Discover 1800s
Torpedo
Apple Mobile
Devices Cleared For
Use On US Military
Networks
Mice, Newts
Retrieved After a
Month Orbiting
Earth At 345 Miles
Up
IBM Takes System/z
To the Cloud With
COBOL Update
Google"s Nexus Q
Successor Hits the
FCC
Yahoo Board
Approves a $1.1B
Pricetag For Tumblr
Trade Group: US
Software Developer
Wages Fell 2% Last
Year
Wikileaks Releases
Docs Before Trial
of TPB Founder Warg
John McAfee"s
Belize Home Burns
To Ground
Amazon, Google and
Apple Won"t Need To
Pay Tax, Despite
Goverment Threats
Article viewer

Functions, Defines, and Variable Defintions



Written by:dimport
Published by:sefo
Published on:2003-06-21 07:19:46
Topic:Assembly
Search OSI about Assembly.More articles by dimport.
 viewed 7948 times send this article printer friendly

Digg this!
    Rate this article :
This tutorial is for those who know Win32 API programming in C, C++ or simular language, know the concepts of Event-Driven programming, have a working knowledge of the basic Win32 API, know assembly and who want to learn Win32 assembly.
If you do not know Event Driven programming, read the tutorial I wrote on GUI - Event Driven programming OR get a book on beginning windows programming.

Introduction

First off, I want to explain that programming Assembly for Win32 can be as easy as programming C. So, we will start with the API and how to use the definitions.

Before you can start programming Win32 Assembly, you need to define structures and functions. When using C, all this is done for you, you just #include and done!
Well, in Assembly, unless you search the web or you have an assembler other than tasm that may have .INC''s, you have to define all your prodecures & structures.

Luckily, tasm does have a WIN32.INC which does define a lot of data types and a few functions (But not many).
Under TASMEXAMPLESWAP32 you will find WIN32.INC. You can use this and add on to it. That is a lot better than starting off with nothing.

Essay

We will start with how to define functions. This is quite simple, just:

extrn BeginPaint:PROC

That's it! Remeber, Win32 IS case sensitive in some areas, and this is one of them.

CALL BeginPaint ; A Call To Begin Paint

Simple. We will get to parameters in a bit.
But, there is one catch: UNICODE.
UNICODE is something I do not really know a lot about. It has something to do with the way Character strings are stored. There are two types:

ANSI
WIDE CHARACTER.

UniCode defines the wide character form. If you have the C header files, you can do a GREP (This comes with TASM) on UNICODE and you will see how functions are redefined.
I assume ANSI for all my programs.

Wide character for (I think) means each character is 2 bytes instead of one. But I am not sure, if someone knows UNICODE and wants to explain it totally please email me.
So, when you define any function that has String Input, you MUST define it with either an A on the end or a W on the end. (I always do A cause I use ANSI)

extrn TextOutA:PROC

That is how TextOut would be defined. Now, you would have to:

CALL TextOutA ; Call to Text Out Ansi
Of course,to avoid the annoying A/W thing you can:

TextOut equ

Then Just

CALL TextOut ; Call To Text Out

If your program wanted to change to Wide character then, you would only have to change the extrn and equ instead of the whole program so this is a good idea and good practice.
Next on the list is defining the Data types/structures.

Well, that''s simple. It would be a good idea to have a API reference with the Functions & Data type defines structures so you can define them in your program. Or, if you have a windows C compiler like Watcom or Visual C you may grep -w directory*.h to find structure defines so you may define them in your WIN32.INC.

Defining Structures:

 MSGSTRUCT struc
    msHWND UINT ?
    msMESSAGE UINT ?
    msWPARAM UINT ?
    msLPARAM ULONG ?
    msTIME ULONG ?
    msPT ULONG 2 dup(?)
MSGSTRUCT ends

Defining Types:

HDC equ

Now, I will show you how to pass parameters.
There is a function of TASM 5.0 to pass like high level, with all
your parms in the call:

CALL FUNC, Parms


This is a bit TOO high level for me, might as well start using C, and Asm in Win32 is High Level Enough!! But, if you like that way, you can use that way. Here is the Manual way:
(P.S. I would do a L equ so you can use on the Pushes to make sure that dword parms are pushed as dwords if you push a VALUE or Value Defintion like equ''s. Pushing offsets, memory locations or registers is fine since the compiler will know the size.)

PUSH L 0
PUSH L 0
PUSH L 0
PUSH OFFSET Msg
CALL GetMessage ; Call Get Message

Now, you see that the parameters are pushed on backwards.
in C:


GetMessage(&Msg, 0, 0, 0); // 0 or NULL

Anyway, you see that the parameters are pushed on backwards.
(TIP: If you like the C ''NULL'' idea NULL equ ; C Sytle Null''s)
All return values are in EAX. So, as in our example, you know that the GetMessage returns a ZERO when your application quits.

 MessageLoop:
  PUSH L 0
  PUSH L 0
  PUSH L 0
  PUSH OFFSET Msg
  CALL GetMessage ; Call To GetMessage
  TEST EAX, EAX ; Quit Loop?
  JZ SHORT EndProgram
  PUSH OFFSET Msg
  CALL TranslateMessage ; Translate Message
  PUSH OFFSET Msg
  CALL DispatchMessage ; Dispatch Message
  JMP SHORT MessageLoop
 EndProgram:
  PUSH [Msg.wParam]
  CALL ExitProcess ; End Program

As you see, the Return value of GetMessage is in EAX.

This article was originally written by indelible

Did you like this article? There are hundreds more.

Comments:
<none>
Anonymously add a comment: (or register here)
(registration is really fast and we send you no spam)
BB Code is enabled.
Captcha Number:


Blogs: (People who have posted blogs on this subject..)
jackier
jackier on Mon 13th Oct 10am
111
sefo
Sneak - encryption on Fri 17th Nov 12pm
I'm developing the win32 version of sneak: http://snarkles.net/scripts/sneak/sneak. php The ASM source code is available on cyberarmy svn (for members only - free) Check the forum for details: http://www.cyberarmy.net/forum/sneak/mes sages/295244.
sefo
Geek Toolbar on Mon 13th Nov 8am
This a very simple and small toolbar I wrote in my spare time. I use the same set of tools very often and I find it very annoying to look for them in the start menu, on the desktop or in explorer. http://www.osix.net/modules/folder/index .php?tid=134
sefo
BinScan and Alternate Data Stream on Thu 27th Jul 9am
BinScan I created this tool to quickly identify modifications in the PE, use of a TLS callback and Alternate Data Streams. -> Some modifications done in the PE structure of an executable can prevent debuggers or other tools to open the executable.
sefo
Wmf Creator on Wed 26th Jul 7am
Now that the blog is online, I'll be able to share two or three tools I wrote. The first one I'd like to share is WMF Creator. I already put a link in the comments of my article: Wmf Exploit but I thought it would look nicer here. This tool will tak

Test Yourself: (why not try testing your skill on this subject? Clicking the link will start the test.)
Reverse Engineering by Geek_Freek

A test to check your assembly and reversing skills.
Assembly Language - non compiler specific by TroPe

You can test your assembly knowledge by taking this test. It starts out relatively easy, but gets progressively hards very quickly! If you know assembly, or just want to see what you DONT know about assembly, this test is for you. A more advanced assembly


     
Your Ad Here
 
Copyright Open Source Institute, 2006