The MASM Forum Archive 2004 to 2012

General Forums => The Campus => Topic started by: cicciounico on July 12, 2010, 10:21:41 AM

Title: [Niewbies]: translate invoke with GetProcAddress
Post by: cicciounico on July 12, 2010, 10:21:41 AM
Hi,
How can translate:

LOCAL sinfo  :STARTUPINFO
invoke RtlZeroMemory, addr sinfo, sizeof STARTUPINFO
with GetProcAddress?

I have try to write this code:
invoke MyGet,ADDR NtDllName,ADDR MyCriptStr ; RtlZeroMemory
mov hwndProc, eax 
push sizeof STARTUPINFO
push addr sinfo <-- Here Error
call hwndProc  ;invoke RtlZeroMemory, addr sinfo, sizeof STARTUPINFO

Thanks
Title: Re: [Niewbies]: translate invoke with GetProcAddress
Post by: Ghandi on July 12, 2010, 01:10:57 PM

push addr sinfo <-- Here Error

could be

lea eax, sinfo
push eax


You cannot directly push the address of a local variable, you need to point a register at it or reference it in some indirect way then push that reference. I'm sure someone else can word it correctly, i just know what has caused me errors, lol. I also recall reading that it is better to use the variable name for 'sizeof' rather than the structure it represents. But thinking about it, if the structure is declared and the local is declared as an instance of that structure, what is the actual difference between:


push sizeof STARTUPINFO

or

push sizeof sinfo



Can someone shed some light on that?

HR,
Ghandi
Title: Re: [Niewbies]: translate invoke with GetProcAddress
Post by: cicciounico on July 12, 2010, 03:43:00 PM
Yesssss!   :bg
Now work!
This is a correction:
push sizeof STARTUPINFO
lea eax, sinfo
push eax

thanks    :U   :cheekygreen:
Title: Re: [Niewbies]: translate invoke with GetProcAddress
Post by: dedndave on July 12, 2010, 03:59:25 PM
Quotepush sizeof STARTUPINFO

or

push sizeof sinfo



Can someone shed some light on that?

just a guess here....

the assembler treats STARTUPINFO as a structure, but treats sinfo as just an offset
Title: Re: [Niewbies]: translate invoke with GetProcAddress
Post by: sinsi on July 13, 2010, 01:05:24 AM
There should be no difference in using the var or the struc. The only catch is is you have an array of strucs, if you use 'sizeof var' you get the total size of all structures whereas using 'type var' gives you the size of one structure.