 INFECTED VOICE        ISSUE 98'09      (C)1994-98, by STEALTH group
 online h/p/v/a zine     (russian)      http://sourceofkaos.com/stealth
                                        mailto:noxyucT@usa.net

  WIN'95  .
 -  API
 -    WIN'95


   p, ᠫ  p ,p᪨ p pp  BBS'
,砫  pp  ᥡ  Pentium' p lamer'  gamer'.
 ⥬   ⮦ lamer'᪠- 稩 95- mustdie.  p ,
 ⮫쪮  ᨤ 襬 ᮧ  DOS-.,, ,
 pp , KERNEL32.DLL     祣
⢮p. ⮫쪮  㧭, ᨤ  comp' ᨤ WINDOWS ? ᫨
p p  PE-䠩,訬 p묨 魨  WINDOWS API
GetWindowsDirectoryA  GetSystemDirectoryA.pp 맮   :
                    push  pp p,㤠 㤥 ᪮p 
                    push  ᬥ饭  ⮬ p
                    call  32-⭮ ᬥ饭  JMP_Table
,  p   ᯮ짮 䨪p p (RVA) p
맮 API.  楫  API GetProcAddress,p
RVA  ᯮpp㥬   㭪樨 KERNEL32.DLL . p p
WINDOWS-95 GetProcAddress  ᯮ짮  祭 p API,
e  p浪 p ( ⠪ ⭮   VxDCall),
⥬   뫠 ⭮ pp.⮡  RVA API-㭪樨
GetProcAddress,㦭 pp ⠡ ᯮpp㥬 ⮢
KERNEL32.DLL (Image_Export_Directory), ᠬ  ᥡ  ⠪  ᫮.
p祬,ᬮp ᠬ :
-----------------------------------------------------------------------------
    .386
    locals
    jumps
    .model flat,stdcall
extrn      ExitProcess:proc
extrn      MessageBoxA:proc
;----------------------------------------------------------------------------
    .data
our_API       db  'GetProcAddress',0
name_size     equ $-our_API
;
NumofNames    dd  0
AddofFunc     dd  0
AddofNames    dd  0
AddofOrdinals dd  0
;
API_RVA       dd  0
;
test_API_name db  'GetSystemDirectoryA',0
test_API_RVA  dd  0
messbox_name  db  'The name of your SYSTEM directory is',0
messbox_text  db  80h dup (0)
;---------------------------------------------------------------------------
    .code
hmodule       equ 0BFF70000h            ;p KERNEL32.DLL
begin:
         xor  eax,eax
         mov  esi,hmodule
         add  esi,3ch                   ;ESI=㪠⥫  PE-
         lodsw
         add  eax,hmodule
         xchg esi,eax                   ;ESI->砫 PE-
         cmp  word ptr [esi],'EP'       ; ⢨⥫쭮 PE- ?
         jne  exit
         add  esi,78h                   ;ESI->Image_Export_Directory  RVA
         lodsd
         add  eax,hmodule
         xchg esi,eax                   ;ESI->砫 Image_Export_Directory
;----------------------------------------------------------------------------
;                ᠭ  ⠡ Image_Export_Directory
;    饭 :                ᭥ :
;       +00         ppp  ( p = 0 )
;       +04           p ᮧ 䠩
;       +08         p pᨨ (major/minor)
;       +0         RVA p ASCIIZ    Export_Directory
;       +10         砫 p p ᯮpp㥬 㭪樨
;       +14         ⢮ ᯮpp㥬 㭪権
;       +18         ⢮ 㭪権,ᯮpp㥬  
;       +1         RVA ᨢ pᮢ ᯮpp㥬 㭪権 (Address_Table)
;       +20         RVA ᨢ 㪠⥫   ᯮpp㥬 㭪権
;       +24         RVA ᨢ p ᯮp  ᯮpp㥬 㭪権
;----------------------------------------------------------------------------
         add  esi,18h                   ;  㦭  
         mov  edi,offset NumofNames
         mov  ecx,4
         cld
         rep  movsd                     ;᪮p㥬  Export_Directory
         mov  edx,NumofNames            ;EDX=᫮ ᯮpp㥬 㭪権
         mov  esi,AddofNames
         add  esi,hmodule
         mov  edi,AddofOrdinals
         add  edi,hmodule
search_API:                             ;饬 p ᯮpp㥬 㭪権
                                        ;API GetProcAddress
         lodsd
         add  eax,hmodule
         push esi
         push edi
         xchg esi,eax                   ;ESI->砫  API
         mov  edi,offset our_API        ;EDI-> 蠡 
         mov  ecx,name_size             ;pp 蠡
         repe cmpsb                     ;p  訬 蠡
         pop  edi
         pop  esi
         je   API_found                 ; API ᮢ  蠡 !
         inc  edi
         inc  edi
         dec  edx
         jnz  search_API                ; 饬
         jmp  exit                      ;祣  諨-室...
API_found:
         xor  eax,eax
         mov  ax,word ptr [edi]         ;AX=  ⠡ Address_Table
         shl  eax,2                     ;㬭   4 ,.. 
                                        ;Address_Table  dword
         mov  esi,AddofFunc             ;ESI->砫 Address_Table
         add  esi,hmodule
         add  esi,eax
         lodsd                          ;EAX=RVA  API GetProcAddress
         add  eax,hmodule
         mov  API_RVA,eax
test_result:                            ; ⥯p pp  ⮤
         push offset test_API_name      ; API,RVA p  㦥
         push hmodule                   ;p KERNEL32.DLL
         call dword ptr API_RVA         ;砥 RVA API GetSystemDirectoryA
         mov  test_API_RVA,eax
;p 㧭  ⥬ pp WINDOWS
         mov  ecx,80h                   ;pp p  
         push ecx
         push offset messbox_text       ;ᬥ饭  p
         call dword ptr test_API_RVA    ;뢠 API GetSystemDirectoryA
         xor  eax,eax
         push eax
         push offset messbox_name
         push offset messbox_text
         push eax
         call MessageBoxA               ;뢥 MessageBox  
                                        ;System_Directory
exit:
         xor  eax,eax
         push eax
         call ExitProcess               ;室  pp (p)
              end begin
-----------------------------------------------------------------------------
     DOS-only pᠬ,p .㦥 DOS-pp 
 㧭  ⮯ WINDOWS ?   ,   
pp  :
-----------------------------------------------------------------------------
         .model tiny
         .code
          org  100h
begin:
          mov  si,2ch
          lodsw                        ;AX=ᥣ ENVIRONMENT
          mov  es,ax
          xor  dx,dx
          cld
search_string:                         ;饬 p 'windir='
          mov  di,dx
          mov  si,offset dirname       ;SI->蠡
          mov  cx,7
          repe cmpsb                   ;p  蠡
          je   string_found
          inc  dx
          cmp  dx,2000h
          jb   search_string
          jmp  no_windows              ;᫨誮 p Environment...
string_found:
          mov  si,di
          mov  di,offset win_path
          push es
          pop  ds
          push cs
          pop  es
store_string:                          ;p p   pp
                                       ;WINDOWS    p
          lodsb
          stosb
          or   al,al                   ; p ?
          jnz  store_string            ; 
          push cs
          pop  ds
          mov  ax,1613h                ;㭪 祭   pp
          mov  cx,80h                  ;pp p
          mov  di,offset reg_path      ;ES:DI=p p
          int  2fh
          mov  ah,9                    ;뢥  p p
          mov  dx,offset out_text
          int  21h
          int  20h
no_windows:
          mov  ah,9
          mov  dx,offset err_msg
          int  21h
          int  20h
dirname   db   'windir='
out_text  db   'MS WINDOWS location '
win_path  db   80h dup (0)
          db   13,10
          db   'REGISTER   location '
reg_path  db   80h dup (0)
          db   13,10,'$'
err_msg   db   'MS WINDOWS is not loaded :( $'
                end begin
-----------------------------------------------------------------------------
 ,ᮧ multi-executable p (.. p饣 p
p executables  p ⮬ 饣   ⥬ ppᠬ 
 p pp)  p樯 .⠥ ⮫쪮 
 p筮 ᯮ     設   DOS-  PE-  䠩.
, 楯窠  p쭮 ( V86) p
              B8 CD AB  mov  ax,0abcdh
              0B C0     or   ax,ax
p ᯮ  WIN32-pp 㤥 룫拉  mov  eax,0c0babcdh !
⮬ ᯮ짮   ⮣  ⪠   16-  32- pp來
executables ⨬.

                                                              Mad  Rocker

