Run MessageBoxA from Rundll32.exe - cmd

I'm trying to run a MessageBoxA from User32.dll with Rundll32.exe.
As I see in Microsoft references Rundll.exe is for 16-bit applications while Rundll32.exe is for 32-bit ones.
So I write this command :
Rundll32.exe User32.dll,MessageBoxA 0,"Text","Title",0
But nothing shows!
I think there is something wrong with my syntax. Is there anyway to show a MessageBoxA from Rundll32.exe?

Related

Masm invoke createfile does not work

I am trying to create a file under C:\ in Masm code.
but can never success. I don't know where is wrong with the code.
INCLUDE Irvine32.inc
.data
fileName BYTE "C:\\haha.txt",0
fileHandle HANDLE ?
.code
main PROC
INVOKE CreateFile,
ADDR filename, GENERIC_WRITE, DO_NOT_SHARE, null, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,0
exit
main ENDP
END main
if I change the
fileName BYTE "haha.txt",0
it will success write the file haha.txt on the program's folder.
i dont understand why it does not write out to C:\
also, i am using visual studio 2013 and i run the program by run it under debug,start without debugging.
It is a permission problem. If you run the program as administrator, you will see that the file is created.
Just tested it with your code and it works.

NASM trouble with Windows 8.1 64-Bit

I'm having some trouble getting NASM to work at the moment. I have to get it installed for a subject that I'm doing at college. I have Windows 8.1 Pro 64-bit installed. I managed to get NASM installed by downloading the latest version.
Our first task is just to copy the code to a Hello World program and get it running. Here's the code below:
bits 16
org 0x100 ; Start the program at offset 100h
jmp main ; Jump to main program
message: db 'Hello World', 0ah, 0dh, '$'
main: mov dx, message ; Start address of message
mov ah, 09 ; Prepare for screen display
int 21h ; DOS interrupt 21h
int 20h ; Terminate program
So I saved that as prog1.asm and used a batch script that our lecturers gave us to compile it. The batch script is this:
nasm -f bin %1.asm -o %1.com -l %1.lst
When I type in as prog1.asm into cmd it compiles without error, although as soon as I type in prog1 to run the program I get the following error in the cmd window:
This version of C:\Users\########\AppData\Local\nasm\prog1.com is not compatible with the version of Windows you're running. Check your computer's system information and then contact the software publisher.
I don't know what to do really and no matter what I try or Google, nothing seems to give me a straight answer or a proper solution.
The program you've built is a DOS program - it won't run directly in Windows (you might be able to run it in compability mode in Windows XP/9x, but certainly not on your 64-bit edition of Windows 8.1).
You'll need to run your program in some sort of emulator that can handle DOS programs. Probably the most popular one is DOSBox.
If you choose DOSBox you can use a 3rd party front-end to configure things. Or you can just start up DOSBox, then at DOSBox's prompt type:
mount c: <the directory where prog1.com is located>
c:
prog1
I had the same issue with the same exercise.
I have Windows 7 64bit.
My solution was this:
Downloaded and Installed DosBox
Downloaded 16bit version of NASM from:
http://prdownloads.sourceforge.net/nasm/nsm09838.zip?download
(other versions of NASM gave me weird errors)
Unzipped NASM to c:\nasm16
Using notepad, created prog1.asm file (with containing code) in c:\nasm16\
Copied the "as.bat" file into c:\nasm16\
Ran DosBox, and in Dosbox ran command:
mount c c:\nasm16
Open mounted drive with command:
c:\
ran command:
as prog1
And it worked hooraa! :)

.effmach x86 failed to swtich from 64bits to 32 bits

I use Windbg 64 bits to debug a program (32bits, langage C), this program contains exceptions.
In my program I recolte informations about exception occured, especialy ExceptionRecord and ContextRecord and I call batch file that call cdb.exe (64bits).
The line in batch file where I call cdb.exe is:
cdb.exe -p %PID% -pd -loga %LogFile%.txt -lines -c ".echo ;.echo *** Call stack of module causing abort ***;.effmach x86;.cxr %ContextRecord%;kp; .dump /ma %LogFile%.dmp;q" > nul
Where %PID% : my process Id
So, when I use ;.load wow64exts;!sw; instead .effmach x86, the debuger run and show me exactly what I need (The line and function caused exception), but when I use .effmach x86, the batch file stop runing, or crash, or I don't know, but there is no result and the logfile not created.
My question: Why .effmach x86 crash my batch file?
Thanks
I use Windows 7 64 bits
(sorry for my english)
I have find problem
for simple reason, must add space between x86 and next semicolon ; (x86; architecture doesn' exist)

WinExec with start command gives ERROR_FILE_NOT_FOUND

In my application, users can store a command to be run at a certain point. Right now, someone added "C:\Program Files\Internet Explorer\iexplore.exe http://www.google.com". This is invoked by using the WinExec function. Now, when this command is changed to "start http://www.google.com", the function returns an ERROR_FILE_NOT_FOUND, while it seems this should work from examples I find online.
WinExec is for starting processes. But what you are trying to do is best done by asking the shell to work out which program is associated with http:// and display the URL with that. What you need to do is call ShellExecute or ShellExecuteEx.
For example:
ShellExecute(0, NULL, "http://www.google.com", NULL, NULL, SW_SHOWDEFAULT);
The reason that start does not work with WinExec is that start is not an executable. It's a built in command handled by the interpreter, cmd.exe. So you could use WinExec if you passed cmd.exe (or the value of the COMSPEC environment variable) and got cmd.exe to call start. But that's the wrong way to do it.
The command should be:
cmd.exe /c start http://www.google.com
and you shoudn't use WinExec, read the note:
Note This function is provided only for compatibility with 16-bit
Windows. Applications should use the CreateProcess function.
if you use WinExec for opening URLs, use ShellExecute by passing open to lpOperation insted:
ShellExecute(NULL,
TEXT("open"),
TEXT("http://www.google.com"),
NULL,
NULL,
SW_SHOWNORMAL);
The URL will be opened in the user default browser.

Restarting explorer.exe only opens an explorer window

The Problem
In one part of a batch file (kind of, see Extra Information) I need to restart
Explorer, so I use the, tried-and-tested method of
taskkill /f /im explorer.exe >nul
explorer.exe
Then this happens
explorer.exe is successfully terminated
explorer.exe is started (see Image 2), but only an
Explorer window opens, which I am left with indefinitely (see Image 1)
I can then only properly restart Explorer by starting a new task from Task
Manager, as, I'm assuming, Win + R is part of Explorer.
Extra Information
Now, I say "kind of" as I'm running the batch file from a self-executing SFX
archive, created with WinRAR. So, when executed, the contents of the archive are
extracted to %temp% and a user-defined file (usually a boot-strapper and, in
this case, my batch file) is run upon successful extraction.
So far, I've deduced
explorer.exe definitely is being fully killed.
The batch file definitely is called and executed correctly, as it runs and
everything else in the script works as designed, except for the line that
starts explorer.exe
The command to restart Explorer isn't "badly timed", or anything, as I've
tried delaying it.
The batch file works perfectly when manually extracted from the archive, so
it's not a problem with the compression or extraction processes.
Even with commands like start explorer.exe | cmd.exe Explorer doesn't
restart properly, so it's definitely not a problem with the .bat file.
I can confirm that it works on Windows XP and Windows 7 x86 but not Windows 7
x64 (which is my system).
Status
At the moment, I'm suspicious of WinRAR, as I've proved that the code itself
works. So, I'm creating the self-executing SFX with different versions of
WinRAR. So far, I've tried versions:
4.11 x86
4.11 x64
4.20b3 x86
4.20b3 x64
and had the same results every time.
I submitted a bug report to dev#rarlab.com yesterday and got a reply from
Eugene Roshal himself this morning
Hello,
SFX module uses ShellExecuteEx to start a setup application.
Normally it works well. I do not know why Explorer decides to switch
to windowed mode.
Now I built a small standalone program
#include <windows.h>
void main()
{
SHELLEXECUTEINFO si;
memset(&si,0,sizeof(si));
si.cbSize=sizeof(si);
si.lpFile="test.bat";
si.nShow=SW_SHOWNORMAL;
ShellExecuteEx(&si);
}
which runs test.bat with contents as in your sample. This program
shows exactly the same behavior as WinRAR SFX, so Explorer is started
in window.
and a second email this morning
Sorry, no advice now. I replaced ShellExecuteEx with CreateProcess
#include <windows.h>
void main()
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
memset(&si,0,sizeof(si));
si.cb=sizeof(si);
CreateProcess(NULL,"test.bat",NULL,NULL,TRUE,0,NULL,NULL,&si,&pi);
}
but result is the same. I tried to use other SW_ flags like
SW_SHOWDEFAULT or SW_RESTORE with ShellExecuteEx also as "open"
and "explore" lpVerb, but it does not help. For now I do not
understand the logic behind this windowed versus desktop mode.
I realise the outlook is grim but, I hope that's of help to someone..
Proof / Evidence
Link to an SFX archive demonstrating this, if anyone wants it:
https://dl.dropbox.com/u/27573003/Social%20Distribution/restart-explorer.exe
You may notice here that I'm running the commands inside a VM (as denoted by
VMwareTray.exe) but it is not a VM-caused conflict. I've tested the exact same
files on my own host system (which is the same OS) and have had the same
results.
Update
I'm experiencing similar "works outside of an SFX archive but not from one"
problems when using REG ADD in a completely different project.
I just don't think SFX archives play nice with batch files.
I think user1631170 is on to something, "I wonder if some part of Win-RAR is running in 32-bit mode? Could you even start explorer64 running from a 32-bit process? I am pretty certain that Windows won't do that."
When I start explorer.exe from ProcessHacker (32-bit process manager), I get an explorer window.
But I can force it to start the 64-bit explorer with this:
%systemroot%\sysnative\cmd.exe /c start /B explorer.exe
sysnative is a keyword that Windows recognizes to bypass the file system redirection for 32-bit/64-bit (http://msdn.microsoft.com/en-us/library/windows/desktop/aa384187(v=vs.85).aspx
Enjoy!
I had this same problem and found that all the solutions here still didn't work from a batch script.
None of these worked completely:
start explorer.exe
start explorer
explorer.exe
explorer
because they all either opened a window (and didn't show the taskbar again), or the batch script then hung thereafter and couldn't execute any more commands
I found that this line in the batch file did work (after killing explorer.exe):
start "" "%windir%\explorer.exe"
and also allowed other commands to be executed after it in the script
This works in Windows 7:
taskkill /f /IM explorer.exe
start explorer.exe
exit
For restarting explorer.exe, this worked for me.
powershell.exe Stop-Process -processname explorer
When you run explorer.exe from an 32-bit application in 64-bit windows, the path will be redirected to the SysWOW64 directory which contains the 32-bit explorer.exe.
In XP64 it wasn't not such a big deal. In the taskmanager you can see the 32-bit explorer.exe running but it did start as the shell. In Windows 10 (as I came to this problem, it looks like it is introduced in Windows 7), the 32-bit explorer.exe is a stub which creates a new instance of the 64-bit explorer.exe. It probably passes a path on the commandline here so the 64-bit explorer.exe opens a window instead of starting the shell.
So it is still like before that you can control whether a window or a shell should be started by starting explorer.exe with or without a path as commandline parameter.
Instead, you should force starting the 64-bit explorer.exe from the 32-bit application and all is ok. To do this, one method is using the sysnative directory as mentioned above. But another method is to use Wow64DisableWow64FsRedirection/Wow64RevertWow64FsRedirection.
I did the latter and can confirm it works nicely. For both CreateProcess and ShellExecuteEx API.
Try
%windir%\explorer.exe
start %windir%\explorer.exe
start /d%windir% explorer.exe
I have seen similar problems before doing this in C#. The process had to be invoked by calling explorer shell rather than explorer window, but I haven't had any problems in batch.
Try using this:
taskkill /im explorer.exe /f
explorer
The difference between the other answers being explorer rather than explorer.exe which has caused problems before for me.
This works on my Win7 x64 PC.
Hope this helps!
The other day, I was having a look through some of WinRAR's more advanced options and came across this tab:
As soon as I saw that I suspected it to be part of the problem and solution, as this issue only ever occurs on Windows 7 x64.
As suspected, using the Default64.SFX module instead of the default Default.SFX module entirely fixed the issue. Finally.
I do not understand why, but it will only for me if using the full path, regardless of your PATH variable.
%windir%\explorer
Have same issue with Visual Studio.
What works for me (Win 7 Pro 64bit):
PPM on Project name select "Properties"
Configuration Properties > Build Events > Pre-Build Event
taskkill /im explorer.exe /f
Configuration Properties > Build Events > Post-Build Event
start "" "C:\Windows\explorer.exe"
But this make other problem (the IDE is frozen after the explorer runs) and now I'm only able to restart the IDE to run build command again...
Use this (.bat with administrative privileges) in x64 or x86
tasklist /fi "imagename eq explorer*" | find /i "explorer*"
if not errorlevel 1 (taskkill /f /im "explorer*") else (
start %windir%\explorer.exe
What worked for me in Windows 7 64 bit was
"C:\Windows\expstart.exe"
or just
expstart.exe
Try adding a explorer.exe key to App Paths in the registry.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\explorer.exe
(Default) C:\Windows\explorer.exe
Path C:\Windows
or copy the following to notepad and save it as a .reg file then run it:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\explorer.exe]
#="C:\Windows\explorer.exe"
"Path"="C:\Windows"
To see the start panel you need to execute the explorer.exe from the system32 folder
taskkill /im explorer.exe /f
cd %WINDIR%\system32
start %WINDIR%\explorer.exe
Easy Context Menu
Just right-click on the desktop and choose Restart Windows Explorer. Enjoy!

Resources