underscore usage

[joerbanno]

Well still learning assembly and more specifically Masm32, I came across some code that I don't quite comprehend.

It is code of the form:

Code Select Expand


.data
Kernel32 db "kernel32.dll",0
Sleepfunc db "Sleep",0

.data?
KernelBase dd ?

.code
invoke GetModuleHandleA, addr Kernel32
mov KernelBase, eax
invoke GetProcAddress, KernelBase, addr Sleepfunc
mov [_Sleep], eax


I don't understand what happens with the statement mov [_Sleep],eax
Somehow the address of the function sleep gets written to where _Sleep points to, but _Sleep is never defined, so what is the semantics of this underscore?
And what does teh statement accomplish?

Thnx Joero

[hutch--]

Joero,

The code appears to be incomplete, there is no variable declaraion for thew variable "_Sleep". All the code is doing is getting its start address in the DLL so it can be called directly.

Code Select Expand


push 100
call _Sleep


You would normally put the _Sleep variable in either the .DATA? section or as a local in a procedure,

Code Select Expand


LOCAL _Sleep  :DWORD


[joerbanno]

Yeah I looked further and there it was:
sleepy:
        push          INFINITE           
        db            0bbh             
        _Sleep        dd 0
        call          ebx   

but I don't understand how this works, is this Position independent Code?

[Vortex]

It looks like that data and code are mixed on the same section.

[joerbanno]

Hmmm,

A somehow related question is, why is the first move

Code Select Expand


mov KernelBase, eax

as opposed to the second

Code Select Expand


mov [_Sleep], eax

Aren't they both pointers?

[zooba]

Actually, that snippet appears to be self-modifying code. The address of the actual Sleep function is inserted at run time and sleepy is called to call Sleep with -1 as the number of milliseconds.

If it is written in MASM, the extra brackets around _Sleep are ignored. Both KernelBase and _Sleep are pointer-sized variables (ie. 32-bit integers) and the two move commands shown are assigning pointers to these variables. To dereference one of them (as the brackets imply) you need to mov eax, KernelBase and use DWORD PTR [eax].

It looks as if it could be position-independent code, but I don't see any reason to bother. Windows will automatically "rebase" your code if required.

Cheers,

Zooba :U