how do i display a data value in a simple messagebox

[UPucker]

if i have a data item that changes, how do i display it in a simple messagebox as follows
.data
count   db  00h

.code
blah
blah
blah
loop:
inc count
invoke dialogbox, null, addr ????, addr caption, mb_ok
cmp count,10
jne loop


someone please help me and post some code

[Tedd]

Basic method..

Code Select Expand

.data
caption db "I'm a messagebox - yay!",0
fmtstr  db "count = %lu",0

.data?
count   DWORD ?
buff    db 128 dup (?)

.code
start:
    mov eax,7
    mov count,eax

    invoke wsprintf, ADDR buff,ADDR fmtstr,count
    invoke MessageBox, NULL,ADDR buff,Addr caption,MB_OK
    invoke ExitProcess, NULL
end start

[UPucker]

OK thanks, but that leads me to another problem. Im getting an error trying to read process memory. Here is the loop I am using

.const
speedchkloc equ 412eb2h





test1:
        mov speedloc, speedchkloc
        mov speedcount, 0
speedloop:       
        invoke Peek,speedloc,1, addr speedtestbyte
        cmp speedtestbyte, 090h
        jne noitisnot
yesitis:
        invoke wsprintf,addr buff, addr fmtstr,speedcount
        invoke MessageBox, NULL,addr buff, addr testXcap, MB_OK
        inc speedloc
        inc speedcount
        cmp speedcount, 14
        je  speedgood
        jmp speedloop
speedgood:       
        invoke MessageBox, NULL,addr testX2, addr testXcap, MB_OK
        jmp testover
noitisnot:
        invoke MessageBox, NULL,addr testX3, addr testXcap, MB_OK
testover:

what i am trying to do is read 10 consecutive bytes from a programs memory using readprocessmemory. It reads them one at a time, compares them to 090h. if equal, display a message "byte 1 is equal". If not equal it displays a "loop ended" message and quits. The loop repeats 10 times or until it finds a byte not equal.

It flows fine by itself but when I added wsprintf it started acting oddly. The first messagebox pops up incorrectly without a border and displays with count=0, then the invoke peek proc displays an error message "couldnt open the specified process". The second message box displays perfectly "count=1". then the third one open without a border, and the "couldnt open the specified process" messagebox appears again. This continues with the odd # boxes displaying properly, and the even boxes with no border followed by the error box.

Please someone help me out. I know its simple, but I cant get it.

[Tedd]

Now I have to ask why you are wanting to do this?

[UPucker]

someone is having trouble with a program i wrote, and instead of having him send me the entire package, i just want to know whats at a particular location. Or write a small app to read the bytes at that location, and pops them in a messagebox so that he can just email that info to me.

I figured out that i was missing an addr at the end of the wsprintf line, but now instead of giving me one hex byte(90) in a bad messagebox, its giving me 407197, which is the location of the byte in my program's data. Do you have a suggestion for that?

.data
speedtestbyte   db  00h
speedstr        db "Byte is %x",0
testXcap         db  "Test Box Caption",0


.data?
buff    db 10 dup (?)

.code

        invoke wsprintf, addr buff, addr speedstr, addr speedtestbyte
        invoke MessageBox, NULL,addr buff, addr testXcap, MB_OK

How do I display the value in speedtestbyte, and not the address of speedtestbyte?

[AeroASM]

I have a feeling that under Win32 you are only supposed to push dwords, not bytes. Therefore when you push the byte (implicitly under invoke) to wsprintf it screws up the stack. Pushing the address worked because addresses are dword sized, but you want the value not the address.

Solution 1: convert the byte to a dword (movzx into a dword register, then pass the register as an argument)
Solution 2: read dwords instead of bytes.

[dsouza123]

Code Select Expand


.data
      b2hlut db "000102030405060708090A0B0C0D0E0F"
             db "101112131415161718191A1B1C1D1E1F"
             db "202122232425262728292A2B2C2D2E2F"
             db "303132333435363738393A3B3C3D3E3F"
             db "404142434445464748494A4B4C4D4E4F"
             db "505152535455565758595A5B5C5D5E5F"
             db "606162636465666768696A6B6C6D6E6F"
             db "707172737475767778797A7B7C7D7E7F"
             db "808182838485868788898A8B8C8D8E8F"
             db "909192939495969798999A9B9C9D9E9F"
             db "A0A1A2A3A4A5A6A7A8A9AAABACADAEAF"
             db "B0B1B2B3B4B5B6B7B8B9BABBBCBDBEBF"
             db "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF"
             db "D0D1D2D3D4D5D6D7D8D9DADBDCDDDEDF"
             db "E0E1E2E3E4E5E6E7E8E9EAEBECEDEEEF"
             db "F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF"
     speedtestbyte   db 0
     buff            db "Byte is "
     speedstr        dw 0,0
     testXcap        db  "Test Box Caption",0

.code
        movzx ecx, speedtestbyte
        lea esi, b2hlut
        mov ax, word ptr [esi+ecx*2]
        mov speedstr, ax
        invoke MessageBox, NULL,addr buff, addr testXcap, MB_OK


The byte to hex string lookup table was from code posted by r22 on win32asmcommunity.

[UPucker]

Thanks AeroASM you were right. I was handing it a byte, and it needed a dword.

After playing with it a little, i figured it out, but now it is ommitting the leftmost byte if it's 00.

Example:
when eax is  00 40 13 7c
it displays "Dword is 40137c"
using "Dword is %x"

I know it has something to do with the format specification. I tried every combination, and cant get it.

[dsouza123]

Display a dword in a message box by quick lookup.

[attachment deleted by admin]

[UPucker]

thank you that was somewhat helpful, but now I am wondering how do I pass more than 4 bytes to the messagebox. Say for instance if I wanted to pass 12 sequential bytes to be displayed in one messagebox?

And what about seperate groupings in a messagebox. Say for instance i wanted to display 12 bytes on one line, 10 on another line, and 5 bytes on another line all in one simple invoke messagebox call?

*edit*
thanks dsouza123 that does solve the problem, and after looking through it and playing a little bit, I can get it to do all I want.

But I still want to know how to do it with wsprintf. For future reference.

[dsouza123]

     szfmt   db "Dword is %08xh",0

As a format string for wsprintf, it will include leading 0's and stick a h after it.

[GregL]

But I still want to know how to do it with wsprintf. For future reference.

Tedd showed you how.  :wink