I'm trying to open a file for reading, read from it, manipulate the data and then write it back to the file. I have to use the CreateFile, GetFileSize, VirtualAlloc, ReadFile/WriteFile, CloseHandle and VirtualFree functions (barebones Windows API).
I've managed to open the file, more or less, but ReadFile fails with ERROR_NOACCESS. GetFileSize returns the correct file size, so up to that should be fine.
What am I doing wrong?
.386
.model flat, stdcall
option casemap :none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
.data
FileIn db 'input.txt',0 ; file to read
FileOut db 'output.txt',0 ; file to write
.data?
hFile dd ?
FileSize dd ?
hMem dd ?
BytesRead dd ?
.code
start:
invoke CreateFile,
ADDR FileIn,
GENERIC_READ,
0,
0,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
0
mov hFile, eax
invoke GetFileSize,
eax,
0
mov FileSize, eax
inc eax
invoke VirtualAlloc,
0,
eax,
MEM_COMMIT OR MEM_RESERVE,
PAGE_READWRITE
mov eax, hMem
invoke ReadFile,
hFile,
hMem,
FileSize,
ADDR BytesRead,
0
invoke CloseHandle,
hFile
(...)
EDIT:
I changed PAGE_READONLY to PAGE_READWRITE, but the problem remains...
Related
Greetings to all the geniuses of the digital age
Yesterday's task is still on the agenda: "Use the GetOpenFileName function to select a file. Check if the file is less than 3 days old, execute it. Otherwise, display a dialog asking to delete the file. If the user needs it, wipe." (Note: If a task is told to use a structure, it must be placed in dynamically allocated memory)"
I figured out how to open the file and now everything works like a Swiss watch. But another trouble arose.
How to determine the age of a file?
In general, I first thought to use GetFileTime to extract all data about the file time, then use FileTimeToLocalFileTime to convert it to local time, and using FileTimeToSystemTime - to system time. Then subtract one from the other using sub, and so on as per the task.
Here, the FileTimeToLocalFileTime function requires a FILETIME structure with the following parameters:
DWORD dwLowDateTime;
DWORD dwHighDateTime;
And the FileTimeToSystemTime function requires a SYSTEMTIME structure with the following parameters:
WORD wYear;
WORD wMonth;
WORD wDayOfWeek;
WORD wDay;
WORD wHour;
WORD wMinute;
WORD wSecond;
WORD wMilliseconds;
And how to be then? How to find the age of a file? Is there any alternative way? And if my method works, then what exactly and from what should I take it?
File.inc
include WINDOWS.inc
include user32.inc
include kernel32.inc
include comdlg32.inc
includelib user32.lib
includelib kernel32.lib
includelib comdlg32.lib
.data
Time_title db ' Lab_3',0
format db 'More than 3 days. Delete file?', 0
buf db 255 dup(0)
hFile dd 0
readed dd 0
hmem dd 0
File.asm
.386
.model flat,STDCALL
option casemap :none ;case sensitive
include Third.inc
include RADbg.inc
Mem_Alloc PROC Buf_Size:DWORD
add Buf_Size,4
invoke GlobalAlloc,GMEM_MOVEABLE or GMEM_ZEROINIT,Buf_Size
push eax
invoke GlobalLock,eax
pop [eax]
add eax,4
Mem_Alloc endp
Mem_Free PROC DATA:DWORD
mov eax,DATA
sub eax,4
mov eax,[eax]
push eax
push eax
call GlobalUnlock
call GlobalFree
Mem_Free endp
.code
Begin:
call main
invoke ExitProcess,NULL
main proc
LOCAL ftCreate, ftLocale: FILETIME;
LOCAL stUTC, stLocal: SYSTEMTIME;
invoke Mem_Alloc, 1000h
mov hmem, eax
invoke Mem_Alloc, sizeof OPENFILENAME
mov edi, eax
assume edi: ptr OPENFILENAME
xor eax, eax
mov [edi].lStructSize, sizeof OPENFILENAME
mov [edi].lpstrFile, offset buf
mov [edi].nMaxFile, 255
invoke GetOpenFileName, edi
invoke CreateFile, [edi].lpstrFile, GENERIC_READ,\
FILE_SHARE_READ, NULL, OPEN_EXISTING,\
FILE_ATTRIBUTE_NORMAL, NULL
mov hFile,eax ;
invoke GetFileTime, hFile, addr ftCreate, NULL, NULL
invoke FileTimeToLocalFileTime, addr ftCreate, addr ftLocale
invoke FileTimeToSystemTime, addr ftCreate, addr stUTC
cmp eax, 1
jz l1
invoke ReadFile, hFile, hmem, 1000h, addr readed, 0
invoke MessageBox, 0, hmem, addr Time_title, MB_OKCANCEL
jmp l2
l1:
invoke MessageBox, 0, addr format, addr Time_title, MB_OKCANCEL
cmp eax, IDOK
jne l2
invoke DeleteFile, addr [edi].lpstrFile
l2:
assume edi: dword
invoke CloseHandle, hFile
invoke Mem_Free, hmem
invoke Mem_Free, edi
ret
main endp
end Begin
As FILETIME and RtlTimeToSecondsSince1970 said, You should copy the low- and high-order parts of the file time to a ULARGE_INTEGER structure, perform 64-bit arithmetic on the QuadPart member.
So, subtract the 64-bit value in the ULARGE_INTEGER structure initialized with the file time from the 64-bit value of the ULARGE_INTEGER structure initialized with the current system time.
I have just started learning assembly, and I am stuck.
I have a character in a WPARAM variable ( can also be DWORD ), and I have to append it to a db string. I have no idea as to how to do it.
Here is my code:
.386
.model flat, stdcall
option casemap: none
WinMain proto :DWORD,:DWORD,:DWORD,:DWORD
include C:\Program Files\masm32\include\windows.inc
include C:\Program Files\masm32\include\kernel32.inc
include C:\Program Files\masm32\include\user32.inc
include C:\Program Files\masm32\include\gdi32.inc
includelib "C:\Program Files\masm32\lib\kernel32.lib"
includelib "C:\Program Files\masm32\lib\user32.lib"
includelib "C:\Program Files\masm32\lib\gdi32.lib"
.data
cn db "Parth",0
an db "Priydarshi Singh",0
char WPARAM 21h
text db "A",0
ps DWORD ?
hin HINSTANCE ?
cmd LPSTR ?
.code
start:
invoke GetModuleHandle, 0
mov hin, eax
invoke GetCommandLine
mov cmd, eax
invoke WinMain, hin, 0, cmd, SW_SHOWDEFAULT
invoke ExitProcess, 0
WinMain proc inst:HINSTANCE, pinst:HINSTANCE, cml:LPSTR, show:DWORD
LOCAL wc:WNDCLASSEX
LOCAL msg:MSG
LOCAL hwnd:HWND
mov wc.cbSize, sizeof WNDCLASSEX
mov wc.style, CS_VREDRAW or CS_HREDRAW
mov wc.lpfnWndProc, offset WndProc
mov wc.cbClsExtra, 0
mov wc.cbWndExtra, 0
push hin
pop wc.hInstance
mov wc.hbrBackground,COLOR_WINDOW+1
mov wc.lpszMenuName,NULL
mov wc.lpszClassName,OFFSET cn
invoke LoadIcon,NULL,IDI_APPLICATION
mov wc.hIcon,eax
mov wc.hIconSm,eax
invoke LoadCursor,NULL,IDC_ARROW
mov wc.hCursor,eax
invoke RegisterClassEx, addr wc
invoke CreateWindowEx, NULL, addr cn, addr an, WS_OVERLAPPEDWINDOW, 0, 0, 1366, 750, NULL, NULL, inst, NULL
mov hwnd, eax
invoke ShowWindow, hwnd, show
invoke UpdateWindow, hwnd
.WHILE TRUE
invoke GetMessage, addr msg, NULL, 0, 0
.BREAK .IF(!eax)
invoke TranslateMessage, addr msg
invoke DispatchMessage, addr msg
.ENDW
mov eax, msg.wParam
ret
WinMain endp
WndProc proc hwnd:HWND, umsg:UINT, wp:WPARAM, lp:LPARAM
LOCAL hdc:HDC
LOCAL rect:RECT
.IF umsg==WM_DESTROY
invoke PostQuitMessage, 0
.ELSEIF umsg==WM_CHAR
push wp
pop eax
mov char, eax
; I need some code here to append 'char' to 'text'
invoke InvalidateRect, hwnd, NULL, TRUE
.ELSEIF umsg==WM_PAINT
invoke BeginPaint, hwnd, addr ps
mov hdc, eax
invoke TextOut, hdc, 0, 100, addr text, sizeof text
invoke EndPaint, hwnd, addr ps
.ELSE
invoke DefWindowProc, hwnd, umsg, wp, lp
ret
.ENDIF
xor eax, eax
ret
WndProc endp
end start
You can only append to a string if there's space available for additional characters.
You've declared text as text db "A",0, which reserves 2 bytes at text ('A' and 0), so there's no room for additional characters. If you know the maximum length that the string ever will be you can still allocate it statically; for example text db 1024 dup(0) would give you 1024 bytes of space where all bytes have the initial value 0. If you have another variable that keeps track of the current number of characters in the string you can use that to append to the string:
mov edi,text_length
mov [text + edi],al
inc dword ptr text_length
If your string can shrink as well as grow you'll have to make sure to insert a NUL terminator at right place when you "remove" characters from the string.
If you don't know the maximum length of the string in advance, or if the maximum is very large, you can allocate memory dynamically with one of the memory allocation functions provided by Windows, e.g. HeapAlloc. If the string is about to grow beyond the currently allocated size you increase the size of the allocated block with HeapReAlloc (e.g. to twice the size of the previous size).
I want to write a MASM program similar to the following C++ program :
#include <Windows.h>
#include <iostream>
typedef UINT (_stdcall *FuncPtr)(LPCSTR lpCmdLine, UINT uCmdShow);
int main(void)
{
HMODULE hDll = LoadLibrary(TEXT("Kernel32.dll"));
FuncPtr func_addr = reinterpret_cast<FuncPtr>(GetProcAddress(hDll, "WinExec"));
(*func_addr)("C:\\WINDOWS\\system32\\calc.exe", SW_SHOWDEFAULT);
FreeLibrary(hDll);
return (0);
}
As you can see, this code execute the microsoft calculator. I just want to do the same thing using MASM but the execution fails.
Here's the MASM source code :
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\masm32.inc
include \masm32\include\msvcrt.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\masm32.lib
includelib \masm32\lib\msvcrt.lib
.data
LpFileName db "kernel32.dll", 0
procName db "WinExec", 0
display db "addr_func = 0x%x", 0
.data?
hModule HMODULE ?
procAddr FARPROC ?
.code
start:
invoke LoadLibrary, offset LpFileName
mov hModule, eax
invoke GetProcAddress, hModule, ADDR procName
mov procAddr, eax
INVOKE crt_printf, ADDR display, procAddr
mov esi, procAddr
call esi
db "C:\WINDOWS\system32\calc.exe"
invoke FreeLibrary, hModule
invoke ExitProcess, NULL
end start
The crt_printf output is correct. The same address is printed like withe the C++ program. So the address passed to call is the same one. However the execution fails.
Here's a MASM32 code which works but this time the address of the function WinExec is hardcoded like this :
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
.code
start:
jmp _Debut
_Final:
TCHAR 233
dword 42424242h
_Suite:
mov esi, 779e304eh
call esi
jmp _Final
_Debut:
xor eax, eax
push eax
call _Suite
db "C:\WINDOWS\system32\calc.exe"
end start
See the line mov esi, 779e304eh. But dynamically, there is a problem. If I disassemble the code just above we can see that the order of bytes is reversed.
8EEH047E379
Maybe it's not the case dynamically and maybe I need a keyword in the following line (between the comma and procAddr):
mov esi, procAddr
I cannot find the solution. I'm lost. Can anyone help me?
Thanks a lot in advance for your help.
The execution fails because you are not passing it's parameters.
Here you just call the function without any arguments or rather with invalid arguments (because whatever is currently on the stack will be taken and the stack is corrupted in the process).
mov esi, procAddr
call esi
You should do
push SW_SHOWDEFAULT
push offset YourPathToCalc
mov esi, procAddr
call esi
In your samplecode this is what is done here implicitly
xor eax, eax
push eax ; uCmdShow
call _Suite ; Returnadress is the address of the commandline so this is bascially the "push path"
Another thing you are missing is, that when WinExec returns, it will start executing the path in your case so you need a jmp somewhere after the call.
And as Gunner pointed out, the path must be 0 terminated.
To add to the correct answer Devolus posted, your path to calc is not NULL terminated.
This
"C:\WINDOWS\system32\calc.exe" is not correct!
Instead it should be:
"C:\WINDOWS\system32\calc.exe", 0
Also, if you are going to put strings in the code section to use, you need to give them a label in order to use them and you need to jump over them otherwise the CPU will try to execute the bytes.
INVOKE crt_printf, ADDR display, procAddr
mov esi, procAddr
push SW_SHOWDEFAULT
push offset Calc
call esi
jmp #F
Calc db "C:\WINDOWS\system32\calc.exe", 0
##:
invoke FreeLibrary, hModule
invoke ExitProcess, NULL
* EDIT *
To convert that code to Assembly using MASM, all that is needed is this:
.data
LpFileName db "kernel32", 0
procName db "WinExec", 0
Calc db "calc", 0
.code
start:
invoke LoadLibrary, offset LpFileName
push eax
invoke GetProcAddress, eax, ADDR procName
push SW_SHOWDEFAULT
push offset Calc
call eax
call FreeLibrary
invoke ExitProcess, NULL
end start
I'm trying to write a program in assembly and one of the first things that I need is the handle of the main window of a specific process. I've been trying to get it using FindWindow, but no luck so far; FindWindow apparently keeps returning zero. Can anyone point out what am I missing here? Thanks.
.486
.model flat, stdcall
option casemap :none
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
.data
NtpTitle db "Untitled - Notepad",0
MsgNoNtp db "Notepad not found.",0
MsgNtp db "Found Notepad.",0
NullString db 0
hWndNtp dd 0
.code
start:
invoke FindWindow, offset NullString, offset NtpTitle
mov hWndNtp, eax
jz noNotepad
invoke MessageBox, 0, offset MsgNtp, 0, 40h
invoke ExitProcess, 0
noNotepad:
invoke MessageBox, 0, offset MsgNoNtp, 0, 10h
invoke ExitProcess, 1
end start
You should set lpClassName to NULL, not the address to an empty string.
invoke FindWindow, 0, offset NtpTitle
You are not testing the return value of FindWindow; mov does not modify flags.
test eax,eax
jz noNotepad
I came across a strange problem with ReadFile(). The textfile is opened correctly but it reads only 4 bytes instead of number of bytes declared in MemorySize. The same code in C is executed properly. Somebody knows what's wrong?
Regards
.DATA
FileName DB "test.txt",0
MemorySize DWORD 10
.DATA?
hFile HANDLE ?
pMemory DWORD ?
SizeR DWORD ?
.CODE
start:
INVOKE CreateFile, ADDR FileName,\
GENERIC_READ, 0, NULL,\
OPEN_EXISTING, 0, NULL
mov hFile, eax
INVOKE GlobalAlloc, GMEM_FIXED or GMEM_ZEROINIT, MemorySize+1
mov pMemory, eax
INVOKE ReadFile, hFile, ADDR pMemory, MemorySize, ADDR SizeR, NULL
INVOKE MessageBox, 0, ADDR pMemory, 0, 0
INVOKE LocalFree, pMemory
INVOKE CloseHandle, hFile
ret
end start
INVOKE ReadFile, hFile, ADDR pMemory, MemorySize, ADDR SizeR, NULL
INVOKE MessageBox, 0, ADDR pMemory, 0, 0
In these two lines, you are passing a pointer to a pointer for pMemory. GlobalAlloc returns a pointer to memory and ReadFile expects a pointer NOT a pointer to a pointer. Remove ADDR and it should work.
INVOKE GlobalAlloc, GMEM_FIXED or GMEM_ZEROINIT, MemorySize+1
This is wrong also. You cannot do MemorySize + 1 as you would to in a High Level Language. In this case you need to do:
inc MemorySize
before your call to GlobalAlloc