
Originally Posted by
Kallisti
Yeah, but if you always rely on the macros and calls to windows, you won't get as good a grasp on how to do it.
Rely on macros..? Uh what? When you disassemble an application, there are no macros shown/created/used. The code is compiled down to the bare ASM of what is used to make the application work. Macros are handled by an interpreter at compile time. They never make it into the application itself. They unfold and are injected into the position they are used during compile time.
For example, writing a macro to call MessageBoxA in C++:
Code:
#define MSGBOX( hWnd, msg, caption, flags ) \
MessageBoxA( hWnd, msg, caption, flags );
BOOL APIENTRY DllMain( HMODULE hModule, DWORD fdwReason, LPVOID lpReserved )
{
MSGBOX( 0, "Hello world!", "Hello!", MB_OK );
return TRUE;
}
Compiles down to: (Default settings, debug mode, no optimization)
Code:
0F431550 >/> 55 PUSH EBP
0F431551 |. 8BEC MOV EBP,ESP
0F431553 |. 56 PUSH ESI
0F431554 |. 8BF4 MOV ESI,ESP
0F431556 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
0F431558 |. 68 D0C5430F PUSH gtasa_sa.0F43C5D0 ; |Title = "Hello!"
0F43155D |. 68 D8C5430F PUSH gtasa_sa.0F43C5D8 ; |Text = "Hello world!"
0F431562 |. 6A 00 PUSH 0 ; |hOwner = NULL
0F431564 |. FF15 0CF4430F CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
0F43156A |. 3BF4 CMP ESI,ESP
0F43156C |. E8 7F230000 CALL gtasa_sa._RTC_CheckEsp
0F431571 |. B8 01000000 MOV EAX,1
0F431576 |. 5E POP ESI
0F431577 |. 3BEC CMP EBP,ESP
0F431579 |. E8 72230000 CALL gtasa_sa._RTC_CheckEsp
0F43157E |. 5D POP EBP
0F43157F \. C2 0C00 RETN 0C
And if you write it out without the macro:
Code:
0F981550 >/> 55 PUSH EBP
0F981551 |. 8BEC MOV EBP,ESP
0F981553 |. 56 PUSH ESI
0F981554 |. 8BF4 MOV ESI,ESP
0F981556 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
0F981558 |. 68 D0C5980F PUSH gtasa_sa.0F98C5D0 ; |Title = "Hello!"
0F98155D |. 68 D8C5980F PUSH gtasa_sa.0F98C5D8 ; |Text = "Hello world!"
0F981562 |. 6A 00 PUSH 0 ; |hOwner = NULL
0F981564 |. FF15 0CF4980F CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
0F98156A |. 3BF4 CMP ESI,ESP
0F98156C |. E8 7F230000 CALL gtasa_sa._RTC_CheckEsp
0F981571 |. B8 01000000 MOV EAX,1
0F981576 |. 5E POP ESI
0F981577 |. 3BEC CMP EBP,ESP
0F981579 |. E8 72230000 CALL gtasa_sa._RTC_CheckEsp
0F98157E |. 5D POP EBP
0F98157F \. C2 0C00 RETN 0C
You end up with the same code.

Originally Posted by
Kallisti
for example, instead of actually learning how to make an atoi you would just call the c function. Where is the learning in that?
Or you know.. step into atoi's function and earn how its done? And atoi isn't a macro either.

Originally Posted by
Kallisti
Anybody can move values into the appropriate register and call an external function, but where is the learning in actually knowing how it works in Assembly?[/SIZE]
That is the whole point to what I said.. writing out code in C++ then analyzing what it compiles to in ASM. To understand how things are done, what they translate to, etc. to better understand how to find something being coded, understand the code flow while debugging, and so on.