Reverse Engineering for Beginners

(avery) #1

CHAPTER 53. WINDOWS 16-BIT CHAPTER 53. WINDOWS 16-BIT


return 0;
};


WinMain proc near
push bp
mov bp, sp
xor ax, ax ; NULL
push ax
push ds
mov ax, offset aHelloWorld ; 0x18. "hello, world"
push ax
push ds
mov ax, offset aCaption ; 0x10. "caption"
push ax
mov ax, 3 ; MB_YESNOCANCEL
push ax
call MESSAGEBOX
xor ax, ax ; return 0
pop bp
retn 0Ah
WinMain endp


dseg02:0010 aCaption db 'caption',0
dseg02:0018 aHelloWorld db 'hello, world',0


Couple important things here: thePASCALcalling convention dictates passing the first argument first (MB_YESNOCANCEL),
and the last argument—last (NULL). This convention also tells thecalleeto restore thestack pointer: hence theRETN
instruction has0Ahas argument, which implies that the pointer has to be increased by 10 bytes when the function exits. It
is like stdcall (64.2 on page 648), but the arguments are passed in “natural” order.


The pointers are passed in pairs: first the data segment is passed, then the pointer inside the segment. There is only one
segment in this example, soDSalways points to the data segment of the executable.


53.3 Example #3


#include <windows.h>


int PASCAL WinMain( HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow )
{
int result=MessageBox (NULL, "hello, world", "caption", MB_YESNOCANCEL);


if (result==IDCANCEL)
MessageBox (NULL, "you pressed cancel", "caption", MB_OK);
else if (result==IDYES)
MessageBox (NULL, "you pressed yes", "caption", MB_OK);
else if (result==IDNO)
MessageBox (NULL, "you pressed no", "caption", MB_OK);

return 0;
};


WinMain proc near
push bp
mov bp, sp
xor ax, ax ; NULL
push ax
push ds
mov ax, offset aHelloWorld ; "hello, world"
push ax
push ds
mov ax, offset aCaption ; "caption"
push ax
mov ax, 3 ; MB_YESNOCANCEL
push ax

Free download pdf