Win32 Assembler FAQ

Note: This FAQ covers mainly topics related to assembler programming under Win32. General x86-assembler questions can be found in the x86 Assembly Language FAQ at www.faqs.org and www.frontiernet.net/~fys/faq; general win32 questions can be found in the Win32 Programming FAQ and the #WinProg FAQ. External links open in a new window.

Content:

Assembly programming:

• Assembler, linker and other tools
• Options and directives
• Problems and error messages
• Other x86-assembly related stuff

Win32:

• General Win32 stuff
• Windows and GUI
• Graphic
• System programming
• Various functions

Other stuff:

• Various questions

Assembler, linker and other tools

• Where can I get MASM, TASM or NASM?
• Get them here:
  • MASM: Can be downloaded as a part of the Windows-DDK at MSDN or at Hutch´s MASM32 page
  • NASM: Official homepage: http://sourceforge.net/projects/nasm
  • TASM: Can be bought in various shops
  There are other assemblers as well:
  • GoAsm, combined with GoLink especially made for creating flat memory model 32bit programs. Supports Unicode.
  • Specific Assmembler (SpAsm), an Assembler with an IDE and built-in Win32 and ReactOS support
  • Flat Assembler (FASM), a 32Bit-Assembler supporting DOS and Win32
  • YASM, compatible with NASM and others
  • LZASM, using TASMs IDEAL mode

• Which debuggers are available under Win32?
• Recommended ones are:
  • OllyDbg: www.ollydbg.de
  • TurboDebugger(Win32): www.borland.com/bcppbuilder/turbodebugger
  You may also use the internal debugger included in many IDEs.
  Popular disassemblers are:
  • HT Editor from Steveman and Seppel
  • W32Dasm from URSoftware
  • Clive Turvey´s DUMPPE
  • Interactive Disassembler (IDA) from datarescue.com (x86 only trial version available)
  More disassemblers are listed at Sang Chos page.

• What´s the difference between TASM,TASMX and TASM32? And what´s the difference between TLINK and TLINK32?
• All TASM versions create the same object files. However, the 16bit version is pretty restricted considering the amounts of variables and constants. The 32bit versions TASMX and TASM32 do not have this restriction. TASMX is a DOS program using DPMI and can also be used in the Win32 DOS box, TASM32 is a pure Win32 application. TLINK can only create 16bit files, TLINK32 only 32bit ones.

• Where can I get windows.inc and import32.lib for TASM/TLINK?
• These files are shipped with TASM4 and TASM5. They can be found in the /include and /lib subdirectories.

• Are there special editors or integrated development environments (IDEs) for assembler programming?
• Some more known IDEs are NaGoA or RadASM. As an editor, you may try AsmEdit, Proton, Notepad2 or PFE, but even Notepad or the DOS editor EDIT would do the job. Other programs: TASM IDE and UltraEdit.

• How can I create ressource files?
• You can write the ressource script ()*.rc by hand or create it using a ressource editor (e.g. the one inclued in VC-DevStudio, the one included in the Windows-Reskit or Symantecs ressourc editor) which support WYSIWYG editing. Both GoRC and the GUI editors can compile it into a binary ressource file (*.res) afterwards.

• What is the syntax for ressource scripts?
• A description is delivered with GoRC.

• How to use inline assembler in VC++?
• E.g., like this:

  	_asm
  	{
  	  mov eax,ebx
  	  add ecx,edx
  	}

• And with other C(++) compilers?
• Either in the same way or by writing it like this:

          asm     mov eax,ebx
          asm     add ecx,edx

  Note that there isn´t a common standard, the implementation is always compiler-specific.

• How to write a batch(*.bat) file so that it accepts parameters?
• Do this by using the variables %1, %2, %3 etc. %1 is the first parameter, %2 the second, etc. The first parameter is also used if you drag-and-drop a file or folder onto the batch file using the explorer.
  Example: notepad.exe %1 opens the file passed as a parameter using the standard windows editor.

• Is it possible to use 32Bit MASM for creating 16Bit DOS files?
• You can create 16Bit OMF object files, but you will need a different linker than 32Bit MS LINK in order to create the final executable.

• Is it possible to build an executable without a linker?
• Yes, if the assembler is capable of creating plain binary output files (e.g. NASM). But in this case, you have to build up the whole file structure on your own. An example describing how to do this can be found in the diskmag Hugi, Issue 21

• Are import libraries (.lib) really necessary?
• No, some assemblers support imports already on their own. NASM provides the IMPORT directive for that.

• How can I include a file with binary data into the executable?
• There are several possibilities:
  • Using the ressource compiler to include it into a *.res file (see documentation of the ressource compiler and the corresponding Win32API functions)
  • Use the command line to attach it to the end of the executable: copy /b foo.exe + bar.dat
  • Use a so-called bin2db- or any2db-Tool. This converts binary data into an assembler include file consisting of "db ...." lines.
  • NASM supports the %incbin directive which includes binary data without parsing it. Even if you do not use NASM, you may create an object file containing the binary data and use this in your project.

• What´s the difference between object files (*.obj) and libraries (*.lib)?
• Object files are always added entirely to the linked executable. Libraries can also contain multiple parts as well, where only the components used are added by the linker.

• Where can I find LIB.EXE (by Microsoft)?
• There is a recent version of lib.exe in the MASM32 package (see above). But, you may better try out the parameter LINK /lib first ;)

Options and directives

• Is there a list describing all directives and parameters?
• A detailed list of all parameters, directives and error codes for MASM can be found at http://jupiter.cs.wayne.edu/labPages/masmref.htm

• What does the IFDEF directive do?
• It allows conditional compilation: If the expression after IFDEF was defined before the following code will be compiled as well, otherwise, it would be ignored by the assembler. In MASM, the expression can also be specified as a part of the command line by using the /D parameter.

• In the sample code, there are the following lines:

  	IFDEF masm
  	option casemap :none
  	ENDIF

  Can I delete them while using TASM?
• Sure, because the expression masm was only defined for the MASM assembler.

• Why is the directive option casemap:none used?
• It enables case-sensitivity in MASM. This can also be done using the command line. This is important since most Win32-API funcions are case-sensitive.

• What does the parameter /entry:xxx for the Microsoft linker do?
• It tells the linker where the program entry point is.

• What does the parameter /OPT:NOWIN98 for the Microsoft linker do?
• Windows 98 contains an optimization for loading PE files a bit faster if the file alignment equals the memory alignment (typically 4k). By using the /OPT:NOWIN98 option the linker ignores this optimization and is thus able to create smaller files.

• How can I reduce file size using Microsofts linker?
• You may use the option /MERGE:SectionA=SectionZ for merging all sections between SectionA and SectionZ into a single section. Be careful, the linker may set inapropriate section attributes. Additionally, not all merged files may be accepted by the PE loader.

Problems and error messages

• I cannot compile or link the example sources (with or without error messages given)
• The most common cause for this are missing or incorrect files (*.inc, *.lib), wrong command line parameters or incorrect path names. In order solve the problem check at which stage of the build process the first error message appears. Check for every build stage if all files needed by the next were generated. Files and executables are also often broken due to download errors.

• GoRC does not work under Windows2000 or XP
• Get a newer version from GoDevTool.com

• The linker gives the following error: xxx.obj : error LNK2001: unresolved external symbol yyy or unresolved external 'yyy' in resource xxx.asm.
• In this case, either the name of the function yyy wasn´t written correctly (note that most Microsoft libraries use decorated names: _yyy@z), or the import lib itself causes the problem. The second case is usually caused by slight differences in the name used for the function, by using wrong libraries, by incorrect path names and missing files or by the fact that the function isn´t included in the library at all. Note: TLINK32 requires the full path to the *.LIB files! Hint: Use a Hexeditor supporting ASCII-View and search the function name with it in the *.LIB file. Then do the same with the *.OBJ file and check if they are the same.

• The following lines do not work:

  nasm -f elf file.asm -o obj
  alink file.obj -oEXE file.exe

• The first line specifies the ELF format as the assemblers output data, which is used by some Unixes. For Windows, either the OBJ format (-f obj) or the COFF format (-f win32) is required.

• I cannot link an object file created with MASM in a program created using Borlands tools
• This is due to the fact that the object file has been created in the COFF format while the Borland linker uses the OMF(.obj) format. As a solution, you may use a different linker which supports both types of object files, or create a DLL containing the MASM code so it can to be loaded at runtime instead.

• Using NASM, I get the following error message error: invalid combination of opcode and operands while assembling the following line: mov Variable,eax
• The correct line would be: mov [Variable],eax. Without brackets, Variable would be treated as the address of the variable, like a label or other constant value.

• What about debugging? What does "Program has no symbol table" mean?
• First, any Win32 executable and the DLLs attached to its process can be loaded and traced by any debugger. However, only raw adresses and disassembled machine code (not necessarily detected correctly until execution) will be shown. If you want to debug at source code level, a debug information section has to be added to the binary file. If there isn´t any, TD32 will give the notice above and continue without symbolic debug information. Regarding TD32, use the -v switch in TLINK as well as /zi or /zd in TASM for adding debug information.

x86 assembler specific stuff

• The SIZEOF directive doesn´t work.
• In combinatiion with structures the expression STRUCTURENAME_SIZE is often used for getting the size of a structure, otherwise you can do it like this:
  1. define Label1
  2. Put your data here
  3. define Label2
  4. Now the size of the data can be retrieved by:
     size = offset Label2 - offset Label1
  For NASM, the offset directive is not used: size = Label2 - Label1

• How can I create a loop under Win32?
• In the same way as in any other assembly language program: Take either the LOOP instruction or a combination of CMP/TEST/... and a conditional jump Jxx. Note that the LOOP instruction uses ECX rather than CX for counting.

• MASM considers a value within register as unsigned, although it might be negative as well!?
• Use an explicit SDWORD PTR in front of the register in order to force it to signed.

• Is it possible to write recursive functions in assembler?
• Of course. There are two forms of recursive functions: The simple form (tail recursive functions) usually do not call themselves more than once for each recursion step. The original function parameters are not used by the function afterwards, thus there is always the same amount of variables actually used. In order to save stack space and to speed up the function, this one should better be changed into an iterative loop. The second form also uses local variables created in earlier recursion steps, often they call themselves more than once per step. These can also be changed into loops, but a stack or queue is required for it. From the assemblers point of view, a recursive function is not different from others. But one has to take care that the values needed by the algorithm are not overwritten during recursion, thus, local variables (in other words, variables on the stack) are needed within the functions. Globale variables cannot be used for internal function data.

• How can I create local variables?
• In MASM and TASM this can be done using the LOCAL directive. But you can do it by hand as well: Local variables are always on the system stack, in order to reserve space for them just decrease ESP by the amount of bytes needed for the local variables. The resulting value of ESP will contain the adress of the local variable then. At the end of the program block using the local variable, ESP has to be restored to its old value (see also: How can the stack be cleared?) However, static local variables are actually global variables, which can be created using db/dw/dd/dq. The difference is just that they are used only by one function rather than multiple ones.

• How can the stack be cleared?
• There are two possibilities: Either the stack position, that is the value of esp, is saved at the beginning of the program block (maybe by copyinng it into ebp or into a memory variable) and writing it back to esp at the end of the block. Or one adds all bytes pushed onto the stack together and substracts the number of bytes popped. Afterwards, add the result to esp. More about it can be found in the Win32Assembler Tutorial Pt. 4k

• Are other currently running programs affected if the stack is messed up?
• No, just the program with the messed up stack is likely to cause an exception or other error and thus will be terminated by the OS. The only situation in which other programs are affected is that the program which started or monitor the faulty program may get an error message which they can / should handle

• Is it object oriented programming possible in asm?
• It is, because object orientation is a programming style that can be applied to any language. However, except from TASMs ideal-mode there is hardly support for it in the assembler itself, thus most of the stuff has to be done by hand or by using macros. HLA (High Level Assembler) also supports object oriented programming.

• How do I call funktions written in C or another language out of assembler?
• In the assembler source, the function has to be declared as EXTERN or EXTRN. Depending on the compiler the function may need to be decorated using a prepending underscore ("_"). Take care to use the right calling convention: How are the parameters passed (stack, register)? Which registers are be modified? How is the return value passed? What does the parameter order look like? A detailed description of calling conventions can be found at drpaulcarter.com

• Is it possible to call methods contained in virtual C++ classes with assembler?
• Yes, if you know the address of the function table of the object (vtable) as well as the offset of the function in it. More about it can be read in the Win32AssemblerTutorial Pt. 2.78 as well as in the Assembler Programmer Journal (APJ), issue 4, 5 and 8. Read also the question about converting C(++) header files to assembler in this FAQ

• Are the methods within a vtable sorted?
• Not necessarily, especially if additional methods were added later. However, the order of existing function keeps the same between different versions of the object, new functionis are just attached at the end of the vtable.

• How can sine and cosine be calculated in a fast way? What about using MMX?
• The simplest method would be using FSIN and FCOS of the FPU. However, small precalculated tables would be faster (maybe combined with interpolation) or use a taylor approximation: sin(x) = x - x³ / 6 + ... If the values are calculated with consatant parameter change, an iterative solution would do well, you can read more about it at www.active-web.cc/html/research. MMX would only be useful if you compute several sine/cosine values at the same time.

• How can I simplify the code?
• MASM offers several high-level constructs like IF...THEN...ELSE, and the INVOKE directive simplifies function calls, making therm look like in C or Pascal. However, these constructs are not optimized, thus lacking a major benefit of assembler.

• Do I need a new assembler for new CPU instructions?
• No. A new assembler would be the simplest solution, but keeping your old one is also possible: Either define the new instructions in binary using the db xx directive or - if available - use macros which convert the new instructions into binary data on their own.

• Are there any differences between Intel, AMD and other CPUs?
• From the programmers viewpoint the main difference would be different manufacturer names provided by the CPUID instructions. There are also some other differences, but these also exist between various CPUs of the same manufacturer. If you want to know wether the CPU supports a specific instruction or not, you should check the various flags of the CPUID instruction.

• Why store x86-CPUs the data in reverse byte order?
• Well, which one is the normal and which is the reverse order depends on the point of view ;) In both cases, it is just a definition. The order used by x86 has the advantage, that more significant bytes have higher offsets, which is handy for extracting values out of a data stream, but it is less useful for converting words and dwords into readable text.

General Win32 questions

• Does the Win32-API documentation exist for other programming languages as well?
• Only some parts are also available for other languages, but the majority uses C/C++ only.

• Why are the API function names renamed in some sources, e.g.: SendMessageA equ SendMessageA@16?
• This is required by some microsoft tools (linker, VC-compiler) and the corresponding *.lib files. The number following the at sign is the number of bytes pushed onto the stack for the parameters.

• Which registers can be overwritten during a function call? What about callbacks?
• Practically all Win32 API functions, including user callbacks defined within, follow the STDCALL convention. EBX/ESI/EDI and EBP must be preserved, EAX contains the return value, ECX and EDX are free to be overwritten.

• Whats the difference between ressources and normal data sections?
• If a DLL is loaded multiple times, the ressources are only copied once into physical memory. However, this also causes them to be read-only at run time. Ressources are handy in combiantion with ressource loading functions (LoadBitmap, LoadIcon, CreateDialogParam, etc.) or if multiple languages should be supported automatically, otherwise normal data segments are easier to use.

• What´s the matter with the NX bit (non execute)?
• This CPU extension allows marking memory ranges as (non)executable on a paging level - just recall what VirtualProtect as well as the section flags inside the PE header define.

• Can I use self-modifying code under Win32?
• Yes, but the section with the code has to be writable. This can be achieved in several ways:
  • VirtualProtect
  • Setting the writable flag of the .code section
  • Copying the code into a writable data section (.data) or additional allocated memory and executing it there.

• Whats the relationship between Win32-APIs GlobalAlloc and LocalAlloc and malloc() as well as new() in languages like C?
• Basically, they all end up in calling VirtualAllocEx, thus you might directly call this function instead. However, most runtime libraries use optimized versions of malloc() or new() which try to get the requested memory out of a preallocated pool in order to reduce API calls for every small block. Following a new(), the corresponding constructor is also called as well.

• How can I made data accessible to all other processes running?
• Either by using a section with the shared flag set or by using memory mapped files.

• How to change the stack size?
• The linker usually has an option for setting the stack size. More about it can be found in the 4th part of the Win32Asm tutorial.

• How can a program support multiple CPUs (under NT)?
• Separate the problem into multiple threads which require about the same amount of CPU time. These should be as independent from each other as possible, critical sections and similar dependancies reduce parallelism.

• Do instructions like MMX or SSE need special support by the OS?
• That depends on wether the instruction uses already existing registers or not. Instructions like RDTSC, CMOVxx/FCMOVxx which use the standard integer or FPU registers can always be used. The same applies to MMX and 3DNow, since the MMX/3DNow registers are mapped onto the FPU registers and are thus preserved during a task switch. However, instructions sets like SSE and SSE2 use new registers which are not yet preserved by Win95 and older NT versions during a task switch.

• Are there differences in the API functions between Windows9x and NT?
• In some cases Windows9x is less flexible in the valid parameters allowed, e.g., zero pointers are less frequently accepted. On the other hand, NT is much more critical considering valid parameters for access rights, especially considering file system and registry funtions.

• How can I create .inc files out of C header files?
• In order to create your own includes, a text editor is sufficient but it should support replace and replace all functions. The main task is to convert macros and replace some C expressions by their assembler equivalent. There are some h2inc tools which can do most of the work on their own. They can be found shipped along with TASM or available from Chris Dragan´s page, japheth.de or Johannes Kroll

• Where can I get additional DirectX include files?
• Ready-to-use include files can be downloaded from the following addresses:
  • DX6-include-files for TASM
  • DX8 Includes for MASM
  • D3D8 constants for MASM/NASM/TASM
  Otherwise, searching the sites mentioned at win32asm.cjb.net should reveal further links.

• How are the return values of DirectX and other COM methods defined? And how are the offsets of the methods in the vtable defined?
• The return values of the HRESULT type are defined using macros. They contain some additional information as well. A more detailed description can be found in the APJ. The method offsets can be determined by adding 4 bytes for every method in the vtable, starting with 0 (do not forget to count the IUnknown methods Query, AddRef and Release as well).

Windows and GUI

Example code concerning the following questions can be found at Test Department and Ron´s Cornucopia (Download section).

• In which *.LIB or DLL can the CreateWindow function be found?
• Nowhere. CreateWindow is just a macro which calls CreateWindowEx with the additional parameter set to 0.

• How can I add buttons and other user interface parts to a window?
• Most UI elements like buttons are special windows, called controls. These can either be created using CreateWindowEx by specifying the predefined name of the window class (which are described in the API SDK). Or you can use a ressource editor to create a dialog with the elements needed, which is simpler.

• How can I use input via buttons, edit fields and other controls? How to modify those windows?
• These windows create a message for every user action. And they react to messages send to them as well (see the Win32 SDK for a list of all messages which can be used with a certain control). The standard window handling functions can also be used.

• The window procedure does not work properly, especially in conjunction with functions like InitDialog, etc .
• It is always possible that the windows procedure is called again while it is still processing a message (this can be caused by functions like SetDlgItemInt, SendMessage,...). Thus, the same reentrancy rules than for recursive functions apply to the window procedure as well; especially that the variables used inside the window procedure should be local variables (allocated on the stack).

• Which Messages are essential for fluent window handling?
• Unless already handled by built-in window functionality, take care of:
  • WM_CREATE for initializing stuff at window creation
  • WM_PAINT whenever a part of the window needs to be repainted (as a result of resizing, overlaps or user input)
  • Either WM_SIZE and WM_MOVE or WM_WINDOWPOSCHANGED for window sizing and moving. Depending on your application, it might also be sufficient to just react to WM_PAINT instead.
  • WM_CLOSE or WM_DESTROY for closing a window
  • WM_ACTIVATE whenever a window gets (in)active and/or WM_SHOWWINDOW for windows getting (in)visible
  You might also track the messages by using Spy++ (shipped with VC6) for debugging

• Where do I specify wether a window is used as a SDI (SingleDocumentInterface) or as a MDI(MultipleDocument Interface) window?
• The main window is always a standard window. The child windows can then be created by using e.g. CreateMDIWindow. The window procedure of the main window now has to call DefFrameProc rather than DefWindowProc. Windows procedures of child windows call DefMDIChildProc instead.

• I need a table which supports sorting, inserting, selecting, editing and deleting of its entries.
• Looks like the ListView control would be the choice, especialls if it is used in detail view. List modification is done by sending messages.

• What is needed for an application supporting XP-style look&feel?
• At least an XML file called Manifest. It can either be included in to the application as a manifest ressource (see documentation of your ressource compiler) or stored as an external file called the_name_of_your_program.exe.manifest within the application´s directory. Note that other code changes may be needed as well in order to function properly.

Graphic

• Do screen resolutions like 320*240 still work? Are they still useful?
• Except some crappy driver versions, these modes are still supported by all video cards. They are useful in combination with computationally intensive calculations like the ones used for raytraycing. If a specific mode does not exist, a workaround would be to create an OffscreenSurface of the same size and rescaling it to an existing video mode using DirectDraw Blit.

• How can the content of the screen be captured?
• Either by reading the PrimarySurface in DirectDraw compatible mode or by using GDI functions in combination with CreateDC and DISPLAY as device name.

• Whats the easiest way to display colorkeyed sprites?
• The easiest way is using DirectDraw since it has native color key blit support. If GDI functions are used, the bitmap has to be seperated into two parts: One consisting of the pixel mask and one for the sprite itself. It can then be displayed using BitBlt or MaskBlt.

• What are the bit masks for the colors in a pixel?
• The color masks can be obtained at run time by according GDI or DirectX functions. One should never assume that a specific bitmask is granted, since every graphic driver has its own preferences. The most common modes are A1R5G5B5, R5G6B5, A8B8G8R8(GDI bitmaps) and A8R8G8B8, though.

• How can image files be read easily?
• By using one of the existing DLLs and libraries. One of those is already shipped with Win32, called OLEPRO32.DLL and it supports GIF, JPG, BMP and WMF. More information about it can be found at Ernie´s World. There is also a PNG library at madwizard.org

• How to change Control Panel Display Properties?
• First, set the according registry entry to the desired value, then call ChangeDisplaySettings.

System specific

• How can keypresses like ALT-CTRL-DEL be caught?
• If you are using DirectDraw you can specify a flag which disables ALT-CTRL-DEL. Otherwise hook procedures or DirectInput can be used for it. However, the trapped key messages should not be discarded. Emulating them or passing them to the OS afterwards is better.

• How to catch exceptions in a program?
• A description of structured exception handling is available at GoDevTool.com and in APJ, issue 5.

• Under DOS, one could write programs running in the background (called TSRs). How to achieve that in Win32?
• Since Win32 is a multitasking environment, any program can run in the background by default. In order to make a programm seem to run like a TSR, just create a normal windowed GUI application but without displaying the window. See also the next question.

• Under DOS, one could chain interrupts. How to do the same under Win32?
• In most situations messages would already do the job. System-wide processing of events like key and mouse input can be achieved by using the Hook functions of the Win32 API (KeyboardProc, MouseProc, SetWindowsHookEx, UnhookWindowsHookEx, etc.). DLL function calls can be trapped within a process by replacing the calling destinations of the DLL loaded into memory by addresses of your own functions. If you need to access other processes as well, the debug functions have to be used, but these require sufficient access rights. Information about it can be found at internals.com

• How can I access the interrupt table in Win32?
• The adress of the IDT can be obtained using the SIDT instruction. But that does not imply that you can access the table itself... Additionally, interrupts are reserved for use by the kernel. Thus their behaviour depends on the specific OS used.

• Is there a NT kernel mode driver tutorial and privilege levels?
• See Four-F´s page.

• Can I access hardware directly under Win32?
• Win9x/ME allows access to ports which are not already occupied by a driver, NT/2000/XP doesn´t allow direct hardware access at all. In most cases there are drivers which can be used instead, providing a system and hardware independent access. The Win32 file functions can be used to access printer and com ports. If the file functions are not sufficient, the communications functions offer a more specific access to the printer and com ports. If there is no alternative to accessing ports directly, a general purpose driver like WinIO, GiveIO or AsmIO can be used for it, Exagone´s page describes how to do it. You can also write your own driver or communicate directly with an existing driver, but this differs with the driver beeing used. And Win9x drivers are not compatible with NT/2000 drivers and vice versa. You may also modify the PortPermissionBitmap of a task, but this requires a kernel driver as well.

• I need information about executable files headers or PE loading
• Check these:
  • Win32 Assembler Tutorial Chapter 4k
  • www.nondot.org/sabre/os/articles/ExecutableFileFormats/
  • www.microsoft.com/hwdef/
  • Peering Inside the PE: A Tour of the Win32 Portable Executable File Format and
    An In-Depth Look into the Win32 Portable Executable File Format by Matt Pietrek, as well as
    What Goes On Inside Windows 2000: Solving the Mysteries of the Loader by Russ Osterlund, all findable at MSDN
  • Loading a DLL from memory

• What is the PE file checksum and how do I compute it?
• The checksum field is tested for several system libraries and driver components. For normal applications, you can safely set it to 0. If needed, it can be computed using the CheckSumMappedFile function contained in imagehlp.dll.

• Is calling FlushInstructionCache() needed after using selfmodifying code?
• Practically all x86 CPUs detect changes in cached memory automatically, thus calling this function isn´t necessary. However, some x86-CPUs allow disabling this detection for a small speed gain, and other processor families do not detect modified memory content at all.

Various Functions

• How can I read the command line?
• The API function GetCommandLine retrieves the address of the whole command line string.

• How can I find out wether an application was launched from explorer or the command line?
• Check wether the environment variable CMDLINE=WIN is set or not.

• How can I clear the console window?
• You can use the FillConsoleOutputCharacter API function in order to write a block of spaces to the console. Note that the size of the console may vary, so it is recommended to calculate the number of spaces needed using the information obtained by GetConsoleScreenBufferInfo.

• Whats the simplest way to write strings to the console window?
• By using printf provided by MSVCRT.DLL:

  ; Hello, World for the Windows Command Line
  ; Copyright 2007, Daryl Lee
  
  %include "win32n.inc"
  
  EXTERN exit
  IMPORT exit msvcrt.dll
  EXTERN printf
  IMPORT printf msvcrt.dll
  
  segment .data USE32
          MsgContent db "Welcome to Windows Assembly Language Programming", 0
  
  segment .code USE32
  main:
  ..start:
          ; Display message
          push dword MsgContent
          call [printf]
          add esp, 4              ; clean up stack
  
          ; Exit with success code
          push 0
          call [exit]

• How can I get a list of all files in a directory?
• Take a look at the API functions FindFirstFileA, FindNextFileA and FindClose. Attention: Some windows include files use a wrong definition for the constant MAX_PATH: The correct value is 260.
  There are also special functions which can fill controls like combo boxes directly and are easier to use (but allow less flexibility).

• How can I convert errors into strings?
• See API functions GetLastError and FormatMessage

• How to write Explorer shell extensions?
• Sample code is available at Japheth.de and com4me.

• How to eject a CD or use other multimedia functions?
• You can use the MCI interface in winmm.dll. Open the CDAUDIO device using mciSendString, set DOOR to OPEN and then call mciSendString a third time to close it. Sample code about using the multimedia interface can be found at Test Department.

• How can I prevent multiple instances of an application from running at the same time?
• In assembler the most easy solution is defining a Flag contained in a shared data section and testing it at program startup. The program should terminate instantly if it is set, otherwise the program should set it and continue normally. Other methods check the list of all running processes or window classes, use globally broadcasted messages, memory mapped files or the registry (often combined with an own GUID). More specific mechanisms may be used for restricting the limit down to auch a single instance per user, per window, etc. See http://www.codeproject.com/cpp/avoidmultinstance.asp for details.

• How can I add a scripting language to a program?
• Am efficient way would be to use the windows scripting components (JScript or VBScript). Sample code can be found at Ernie´s World

• Are there winsock programming examples in assembler?
• Some links:
  • Winsock FAQ (general winsock FAQ)
  • Test Department (complete Netspy utility in MASM)
  • Madwizard.org (Tutorial)
  • Japheth.de (HTTPD in Asm)
  • Dolphinz page (has sample code)

• How can I change icons and other ressources within a PE file?
• Use the API functions BeginUpdateResource, UpdateResource and EndUpdateResource.

• How can I add Version- and Copyright information?
• Use the VERSIONINFO Ressource with your Ressource compiler. Can even be done multilingual.

Other stuff

• Are there Win32Assembler newsgroups or forums?
• There aren´t special Win32Assembler newsgroups, but a general x86 assembler newsgroups exists: comp.lang.asm.x86. Windows programming questions are discussed in many other newsgroups, often dominated by C(++) programmers, but they are often better for Win32 API questions. A forum can be found at board.win32asmcommunity.net

• Is Win32 slower than DOS?
• Win32 is a multitasking environment supporting access rights. Thus, it is more computationally intensive than DOS. However, todays CPUs are optimized for 32Bit protected mode code rather than 16Bit mode code used under DOS. This does not affect 32Bit DOS programs, but these suffer a lot from the slow transitions between 16 and 32Bit mode needed for calling DOS or BIOS functions. On the other hand, Win32 offers (at least under NT) a complete 32Bit environment and better disk caching and memory management. Additionally, most hardware needs special driver support in order to provide its full functionality. Under DOS there are usually only basic functions available.

• Isn´t assembly outdated today?
• Well, it is also possible to write fast and compact programs in most HLLs. But when every single byte or every single clock cycle counts you can usually still do it a bit better using assembly. And assembler is not more difficult than C if standard libraries are not used. And knowledge about assembler is also helpful for understanding how the stuff works. Special instructions (CPUID, RDTSC, MMX, SSE, most FPU instructions) can only be used efficiently in assembler. In practical programming, most parts are usually written in a HLL, and only some of the most time-critical parts are worth beeing optimized at assembly language level.

• Are there any tools translating assembler code to C code or vice versa?
• Most compilers are capable of producing assembler listings of their object files as well. A conversion from assembler code into another language would theoretically be possible, however, it would not make much sense because it is very unlikely that the result would be the same as original HLL code.

• The sample program win003.exe contained in Win32Assembler Tutorial Pt. 2,718 doesn´t work.
• The sample program uses 32Bit color depth, a fixed pitch and requires DirectSoundCapture. Depending on the system configuration and the drivers beeing used the source code may have to be adjusted accordingly.

• I´ve found a Win32 *.com program - what´s this?
• This is likely to be a DOS com program which drops a PE executable and start this one using the standard DOS functions. These are used for allowing the use of a DOS *.com executable packer as well as for providing a method to compress the Win32 PE header as well. Typical wrappers are "pe2com" or UPEC.

• Full-featured Win32 programs as a *.bat/*.cmd file?
• This technology is known as CAB dropping. Description can be found at www.bytegeiz.de

• Is it possible to use Win32 functions/DLLs in a DOS program?
• There are several possibilities, all having their own limitations:
  1. Using DOS Int21h one can execute RunDLL32.exe in order to call a DLL function. This is only possible with simple functions not expecting handles, pointers or such.
  2. Win9x supports Int2Fh/AX=1684h (called "DEVICE API") for accessing VxD functions within a DOS box.
  3. Or write a custom VxD (Win9x/ME) or VDD (NT/2k/XP) for interfacing between Win32 and the DOS program.