EXE files and apis

[Nacho_dj]

Hello:

If you disassemble the code of your a.exe, you could see imports (with wdasm32, for instance) and there all the apis used by the application. Then, select in the import window "ExitProcess" and display it, then you are getting a "call [<address of ExitProcess>]".

You could write down in your new code a call like that you have got, or a jmp to the RVA of that call.

Cheers

Nacho_dj

[MaRKuS-DJM]

you don't need an API.
MOV EAX,101
PUSH 0 (exit code)
PUSH -1
MOV EDX,ESP
INT 2E

code directly converted in short form from Debug Me 0.2 / Teerayoot

Originally Posted by MaRKuS-DJM

you don't need an API.
MOV EAX,101
PUSH 0 (exit code)
PUSH -1
MOV EDX,ESP
INT 2E

Very interesting, but does this code work on Windows 9x? I think no. Maybe INT 20 (VxDCall) is usable for this...
Interrupts are platform dependent and using call to ExitProcess is much more versatelite. Interrupts are good to avoiding fast detection 'cause I look first for some API call or SEH usage but not for INT's.

[MaRKuS-DJM]

yeah, i forgot to mention this only works on NT-based systems. Windows ME for example will show you the blue screen of death also a way to get the application to shutdown, but not very nice