Reverse Engineering for Beginners

CHAPTER 53. WINDOWS 16-BIT CHAPTER 53. WINDOWS 16-BIT

add ax, 1900
push ax
mov ax, offset a04d02d02d02d02 ; "%04d-%02d-%02d %02d:%02d:%02d"
push ax
mov ax, offset strbuf
push ax
call sprintf_
add sp, 10h
xor ax, ax ; NULL
push ax
push ds
mov ax, offset strbuf
push ax
push ds
mov ax, offset aCaption ; "caption"
push ax
xor ax, ax ; MB_OK
push ax
call MESSAGEBOX
xor ax, ax
mov sp, bp
pop bp
retn 0Ah
WinMain endp

UNIX time is a 32-bit value, so it is returned in theDX:AXregister pair and stored in two local 16-bit variables. Then a
pointer to the pair is passed to thelocaltime()function. Thelocaltime()function has astruct tm allocated
somewhere in the guts of the C library, so only a pointer to it is returned. By the way, this also implies that the function
cannot be called again until its results are used.

For thetime()andlocaltime() functions, a Watcom calling convention is used here: the first four arguments are
passed in theAX,DX,BXandCX, registers, and the rest arguments are via the stack. The functions using this convention
are also marked by underscore at the end of their name.

sprintf()does not use thePASCALcalling convention, nor the Watcom one, so the arguments are passed in the normal
cdeclway (64.1 on page 648).

53.6.1 Global variables

This is the same example, but now these variables are global:

#include <windows.h>
#include <time.h>
#include <stdio.h>

char strbuf[256];
struct tm *t;
time_t unix_time;

int PASCAL WinMain( HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow )
{

unix_time=time(NULL);

t=localtime (&unix_time);

sprintf (strbuf, "%04d-%02d-%02d %02d:%02d:%02d", t->tm_year+1900, t->tm_mon, t->⤦

Çtm_mday,

t->tm_hour, t->tm_min, t->tm_sec);

MessageBox (NULL, strbuf, "caption", MB_OK);
return 0;
};

unix_time_low dw 0
unix_time_high dw 0