Reverse Engineering for Beginners

(avery) #1

CHAPTER 53. WINDOWS 16-BIT CHAPTER 53. WINDOWS 16-BIT


es:[bx]). “far” pointers are also used in myMessageBox()win16 example:53.2 on page 574. Indeed, the Windows
kernel is not aware which data segment to use when accessing text strings, so it need the complete information.


The reason for this distinction is that a compact program may use just one 64kb data segment, so it doesn’t need to pass the
high part of the address, which is always the same. A bigger program may use several 64kb data segments, so it needs to
specify the segment of the data each time.


It’s the same story for code segments. A compact program may have all executable code within one 64kb-segment, then all
functions in it will be called using theCALL NEARinstruction, and the code flow will be returned usingRETN. But if there
are several code segments, then the address of the function is to be specified by a pair, it is to be called using theCALL FAR
instruction, and the code flow is to be returned usingRETF.


This is what is set in the compiler by specifying “memory model”.


The compilers targeting MS-DOS and Win16 have specific libraries for each memory model: they differ by pointer types for
code and data.


53.6 Example #6


#include <windows.h>
#include <time.h>
#include <stdio.h>


char strbuf[256];


int PASCAL WinMain( HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow )
{


struct tm *t;
time_t unix_time;

unix_time=time(NULL);

t=localtime (&unix_time);

sprintf (strbuf, "%04d-%02d-%02d %02d:%02d:%02d", t->tm_year+1900, t->tm_mon, t->⤦
Çtm_mday,
t->tm_hour, t->tm_min, t->tm_sec);

MessageBox (NULL, strbuf, "caption", MB_OK);
return 0;
};


WinMain proc near


var_4 = word ptr -4
var_2 = word ptr -2


push bp
mov bp, sp
push ax
push ax
xor ax, ax
call time_
mov [bp+var_4], ax ; low part of UNIX time
mov [bp+var_2], dx ; high part of UNIX time
lea ax, [bp+var_4] ; take a pointer of high part
call localtime_
mov bx, ax ; t
push word ptr [bx] ; second
push word ptr [bx+2] ; minute
push word ptr [bx+4] ; hour
push word ptr [bx+6] ; day
push word ptr [bx+8] ; month
mov ax, [bx+0Ah] ; year
Free download pdf