home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / WINVCOLL.ZIP / WINTUTOR.ZIP / WININF02.TXT < prev    next >
Text File  |  1980-01-02  |  13KB  |  336 lines
  1.  
  2.            Calling the Windows API in Assembly Language
  3.                             by
  4.                         Qark [VLAD]
  5.  
  6.  
  7.         If you didn't read the windows document in VLAD#4 or don't
  8.         know anything about lowlevel windows structures, then turn
  9.         back now!
  10.  
  11.                 ───────────────────────────────────
  12.  
  13.         Although I designed this document with a view to virus writing,
  14.         I've never seen any information like this anywhere, so it
  15.         could just as easily be used as a general low-level windows text.
  16.         Feel free to use it as such.
  17.  
  18.         I worked out the 'procedure ordinal number listing' by using
  19.         a diskeditor to increase the 'procedure ordinal number' in the
  20.         disk file, and seeing which API was produced by viewing the file
  21.         with a disassembler.  This took many hours.  I only did it for
  22.         the KERNEL functions because they are the only ones that are useful
  23.         for viruses.  If you require pretty windows and scroll bars then
  24.         change the 'index into the module reference table' to refer to GDI
  25.         or USER and work out the 'procedure ordinal numbers' for yourself.
  26.  
  27.                 
  28.                 ───────────────────────────────────
  29.         
  30.  
  31.         To work out the parameters to enter into the API, you will need
  32.         an API listing.  These are normally of phone book proportions
  33.         and I'm not about to type one out, so grab one from your local
  34.         library.  If you can, check to make sure that the book you are
  35.         thinking of choosing lists the selector functions such as
  36.         'AllocCStoDSAlias'.  These functions are considered obselete
  37.         by Windows 3.1, but they are still there, and should be listed!
  38.  
  39.         All parameters passed into an API are done using the stack.
  40.         The values shown in the API listing need to be PUSH'ed in order.
  41.         Any return data will be passed back in AX if it is a word, and 
  42.         DX:AX if a dword.  (I might be wrong about this, but it has worked
  43.         so far!)
  44.  
  45.         For example, my 'Windows API Bible' (which doesnt list the selector
  46.         API functions) says to call "_lopen", which opens a file the same
  47.         as int 21 AH=3dh, do this:
  48.         Syntax: int _lopen (LPSTR lppathname, int ireadwrite);
  49.         Returns: int, file handle, or -1 if error.
  50.  
  51.         Let's analyse the syntax.
  52.         The 'int' at the start means the return value will be an integer,
  53.         which is a word, and thus passed in AX.  If it had said 'LONG' then
  54.         we'd know it was passing back in DX:AX.
  55.         LPSTR is a pointer to an asciiz string (the book tells us this) so
  56.         push the segment, and then offset of the filename to be opened.
  57.         'ireadwrite' is the openmode, so based on experience, 2 will be the
  58.         word pushed to open in read/write mode.
  59.  
  60.         Now here is the full fileopen API all written up, including
  61.         relocation entry and call:
  62.                 ...
  63.                 push    ds              ;ds:dx=filename
  64.                 push    dx
  65.                 mov     ax,2            ;open in read/write mode
  66.                 push    ax
  67.         apicall:
  68.                 db      9ah             ;Call Far Ptr
  69.                 dw      0ffffh          ;Windows needs these.
  70.                 dw      0
  71.                 mov     bx,ax           ;file handle into BX
  72.                 ...
  73.  
  74.         The relocation item is setout like so:
  75.  
  76.                 db      3               ;32 bit pointer
  77.                 db      1               ;Import Ordinal
  78.                 dw      offset apicall + 1      ;Offset of api entry
  79.                 dw      1               ;Index into module reference table
  80.                                         ;of KERNAL.
  81.                 dw      55h             ;Indicate '_lopen' API call.
  82.                                         ;This is the 'procedure ordinal
  83.                                         ;number'
  84.  
  85.         In the relocation I have assumed that the kernal is the first
  86.         thing in the module reference table.  Don't assume this.  In a virus
  87.         you will have to search for it.
  88.  
  89.         I got the '55h' by checking the table below.  The 'procedure ordinal
  90.         number' indicates which API the relocation is talking about.
  91.         If you changed the '55h' to a '56h' it would be a '_lwrite' API
  92.         call instead.  Check below to see why.
  93.  
  94.         When in doubt, ask me about it.
  95.  
  96.                 ───────────────────────────────────
  97.         
  98.  
  99.         Procedure Ordinal Number Listing for KERNAL functions.
  100.  
  101.  
  102.         '*' indicates a handy function.
  103.         If the procedure 'doesnt exist' theres a chance it may be an
  104.         undocumented API.
  105.  
  106.         01h     -       FatalExit
  107.         02h     -       ExitKernal
  108.         03h     -       GetVersion
  109.         04h     -       LocalInit
  110.         05h     -       LocalAlloc
  111.         06h     -       LocalRealloc
  112.         07h     -       LocalFree
  113.         08h     -       LocalLock
  114.         09h     -       LocalUnlock
  115.         0ah     -       LocalSize
  116.         0bh     -       LocalHandle
  117.         0ch     -       LocalFlags
  118.         0dh     -       LocalCompact
  119.         0eh     -       LocalNotify
  120.         0fh     -       GlobalAlloc
  121.  
  122.         10h     -       GlobalRealloc
  123.         11h     -       GlobalFree
  124.         12h     -       GlobalLock
  125.         13h     -       GlobalUnlock
  126.         14h     -       GlobalSize
  127.         15h     -       GlobalHandle
  128.         16h     -       GlobalFlags
  129.         17h     -       LockSegment                     *
  130.         18h     -       UnlockSegment
  131.         19h     -       GlobalCompact
  132.         1ah     -       GlobalFreeAll
  133.         1bh     -       ??? Doesnt exist ???
  134.         1ch     -       GlobalMasterHandle
  135.         1dh     -       Yield
  136.         1eh     -       WaitEvent
  137.         1fh     -       PostEvent
  138.  
  139.         20h     -       SetPriority
  140.         21h     -       LockCurrentTask
  141.         22h     -       SetTaskQueue
  142.         23h     -       GetTaskQueue
  143.         24h     -       GetCurrentTask
  144.         25h     -       GetCurrentPDB
  145.         26h     -       SetTaskSignalProc
  146.         27h     -       ??? Doesnt exist ???
  147.         28h     -       ??? Doesnt exist ???
  148.         29h     -       EnableDos
  149.         2ah     -       DisableDos
  150.         2bh     -       ??? Doesnt exist ???
  151.         2ch     -       ??? Doesnt exist ???
  152.         2dh     -       LoadModule
  153.         2eh     -       FreeModule
  154.         2fh     -       GetModuleHandle
  155.  
  156.         30h     -       GetModuleUsage
  157.         31h     -       GetModuleFileName
  158.         32h     -       GetProcAddress
  159.         33h     -       MakeProcInstance
  160.         34h     -       FreeProcInstance
  161.         35h     -       CallProcInstance
  162.         36h     -       GetInstaceData
  163.         37h     -       Catch
  164.         38h     -       Throw
  165.         39h     -       GetProfileInt
  166.         3ah     -       GetProfileString
  167.         3bh     -       WriteProfileString
  168.         3ch     -       FindResource
  169.         3dh     -       LoadResource
  170.         3eh     -       LockResource
  171.         3fh     -       FreeResource
  172.  
  173.         40h     -       AccessResource
  174.         41h     -       SizeofResource
  175.         42h     -       AllocResource
  176.         43h     -       SetResourceHandler
  177.         44h     -       InitAtomTable
  178.         45h     -       FindAtom
  179.         46h     -       AddAtom
  180.         47h     -       DeleteAtom
  181.         48h     -       GetAtomName
  182.         49h     -       GetAtomHandle
  183.         4ah     -       OpenFile
  184.         4bh     -       OpenPathName
  185.         4ch     -       DeletePathName
  186.         4dh     -       Reserved1
  187.         4eh     -       Reserved2
  188.         4fh     -       Reserved3
  189.  
  190.         50h     -       Reserved4
  191.         51h     -       _lclose                         *
  192.         52h     -       _lread                          *
  193.         53h     -       _lcreat                         *
  194.         54h     -       _llseek                         *
  195.         55h     -       _lopen                          *
  196.         56h     -       _lwrite                         *
  197.         57h     -       Reserved5
  198.         58h     -       lstrcpy
  199.         59h     -       lstrcat
  200.         5ah     -       lstrlen
  201.         5bh     -       InitTask
  202.         5ch     -       GetTempDrive
  203.         5dh     -       GetCodeHandle
  204.         5eh     -       DefineHandleTable
  205.         5fh     -       LoadLibrary
  206.  
  207.         60h     -       FreeLibrary
  208.         61h     -       GetTempFileName
  209.         62h     -       GetLastDiskChange
  210.         63h     -       GetLPErrMode
  211.         64h     -       ValidateCodeSegments
  212.         65h     -       NoHookDosCall
  213.         66h     -       Dos3Call                        *
  214.         67h     -       NetBIOSCall
  215.         68h     -       GetCodeInfo
  216.         69h     -       GetExeVersion
  217.         6ah     -       SetSwapAreaSize
  218.         6bh     -       SetErrorMode
  219.         6ch     -       SwitchStackTo
  220.         6dh     -       SwitchStackBack
  221.         6eh     -       PatchCodeHandle
  222.         6fh     -       GlobalWire
  223.  
  224.         70h     -       GlobalUnwire
  225.         71h     -       __AHShift
  226.         72h     -       __AHinCR
  227.         73h     -       OutputDebugString
  228.         74h     -       InitLib
  229.         75h     -       OldYield
  230.         76h     -       GetTaskQueueDS
  231.         77h     -       GetTaskQueueES
  232.         78h     -       UndefDynLink
  233.         79h     -       LocalShrink
  234.         7ah     -       IsTaskLocked
  235.         7bh     -       KbDrSt
  236.         7ch     -       EnableKernal
  237.         7dh     -       DisableKernal
  238.         7eh     -       MemoryFreed
  239.         7fh     -       GetPrivateProfileInt
  240.  
  241.         80h     -       GetPrivateProfileString
  242.         81h     -       WritePrivateProfileString
  243.         82h     -       FileCDR
  244.         83h     -       GetDosEnvironment
  245.         84h     -       GetWinFlags
  246.         85h     -       GetExePtr
  247.         86h     -       GetWindowsDirectory
  248.         87h     -       GetSystemDirectory
  249.         88h     -       GetDriveType
  250.         89h     -       FatalAppExit
  251.         8ah     -       GetHeapSpaces
  252.         8bh     -       Dosignal
  253.         8ch     -       SetSigHandler
  254.         8dh     -       InitTask1
  255.         8eh     -       ??? Doesnt exist ???
  256.         8fh     -       ??? Doesnt exist ???
  257.  
  258.         90h     -       ??? Doesnt exist ???
  259.         91h     -       ??? Doesnt exist ???
  260.         92h     -       ??? Doesnt exist ???
  261.         93h     -       ??? Doesnt exist ???       
  262.         94h     -       ??? Doesnt exist ???
  263.         95h     -       ??? Doesnt exist ???
  264.         96h     -       Directed Yield
  265.         97h     -       WinOldApCall
  266.         98h     -       GetNumTasks
  267.         99h     -       ??? Doesnt exist ???
  268.         9ah     -       ??? Doesnt exist ???
  269.         9bh     -       GetTaskDS
  270.         9ch     -       LimitEMSPages
  271.         9dh     -       GetCurPID
  272.         9fh     -       GlobalHandleNoRip
  273.  
  274.         0a0h    -       EMSCopy
  275.         0a1h    -       LocalCountFree
  276.         0a2h    -       LocalHeapSize
  277.         0a3h    -       GlobalLRUOldest
  278.         0a4h    -       GlobalLRUNewest
  279.         0a5h    -       A20Proc
  280.         0a6h    -       WinExec
  281.         0a7h    -       GetExpWinVer
  282.         0a8h    -       DirectResAlloc
  283.         0a9h    -       GetFreeSpace
  284.         0aah    -       AllocCStoDSAlias                *
  285.         0abh    -       AllocDStoCSAlias                *
  286.         0ach    -       AllocAlias                      *
  287.         0adh    -       __ROMBIOS
  288.         0aeh    -       __a000h
  289.         0afh    -       AllocSelector                   *
  290.  
  291.         0b0h    -       FreeSelector                    *
  292.         0b1h    -       PrestoChangoSelector            *
  293.         0b2h    -       __winflags
  294.         0b3h    -       __d000h
  295.         0b4h    -       LongPtrAdd
  296.         0b5h    -       __b000h
  297.         0b6h    -       __b800h
  298.         0b7h    -       __0000h
  299.         0b8h    -       GlobalDosAlloc                  *
  300.         0b9h    -       GlobalDosFree                   *
  301.         0bah    -       GetSelectorBase                 *
  302.         0bbh    -       SetSelectorBase                 *
  303.         0bch    -       GetSelectorLimit                *
  304.         0bdh    -       SetSelectorLimit                *
  305.         0beh    -       __e000h
  306.         0bfh    -       GlobalPageLock
  307.  
  308.         0c0h    -       GlobalPageUnlock
  309.         0c1h    -       __0040h
  310.         0c2h    -       __f000h
  311.         0c3h    -       __c000h
  312.         0c4h    -       SelectorAccessRights            *
  313.         0c5h    -       GlobalFix
  314.         0c6h    -       GlobalUnfix
  315.         0c7h    -       SetHandleCount
  316.         0c8h    -       ValidateFreeSpaces
  317.         0c9h    -       ReplaceInst
  318.         0cah    -       RegisterPtrAce
  319.         0cbh    -       DebugBreak
  320.         0cch    -       SwapRecording
  321.         0cdh    -       CvwBreak
  322.         0ceh    -       AllocSelectorArray
  323.         0cfh    -       IsDBCSLeadByte
  324.  
  325.         0d0h    -       ??? Doesnt exist ???
  326.         0d1h    -       ??? Doesnt exist ???
  327.  
  328.         0e0h    -       ??? Doesnt exist ???
  329.  
  330.         0f0h    -       ??? Doesnt exist ???
  331.  
  332.                 
  333.                 ───────────────────────────────────
  334.  
  335.  
  336.