My Favorite function! :)

Code:

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
.data
MsgText db "Womg it's a Virus!",0
MsgTitle db "Do I look fat?",0

Bloat dd 50000 dup (100)

.code
    start:
    ;MessageBoxA
    push NULL
    push offset MsgTitle
    push offset MsgText
    push MB_OK
    call MessageBoxA

    invoke ExitProcess, 0   ;simple invoke

end start

This file came out as a puny 3 kb, but when I added Variable bloat it expanded to hefty 200kb. Womg it's a virus! I tried to make it bigger and it had probs assembling so I'll just leave it like that for now.

I know some of the common instructions:
mov, add, sub, mul, div, dup
... I get the data labels
db, dw, dd, dq which stand for "defining insert data size here"
as well as dword ptr [] I still don't get this one dword ptr ds

ffset (or something like that)
Next comes conditional jump which I am looking forward too...

I was wondering if we could do some kind of challenge game. Like I post a program and someone else debug it and change something in it like a title or something, but all externally so essentially hack the program to do something different. Like a CrackMe, but externally and a lot easier, at least starting off. Sorta like the Error of the week thing BA used to do.

sounds like an awsome plan, altho make sure we send you the sourcecode over PM instead of by topic(to prevent leeches)

That sounds really fun.

I have to try and keep up with you now Why.

you've got your arguments pushing in reverse order - it just works because HWND NULL == MB_OK == 0

Originally Posted by B1ackAnge1

you've got your arguments pushing in reverse order - it just works because HWND NULL == MB_OK == 0

Oh... whatta ya know. I actually meant to do it the other way. You'll notice I got the MsgTitle and MsgText in the right order, but for some reason I slipped up on the 1st and last params... my bad.

My Favorite function! :)

Post a Reply

Similar Threads

Tags for this Thread