Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - Vortex

#1
Tips & Tricks / Re: Detect if running Windows 11
April 01, 2025, 05:11:28 AM
Kevin's methods is reliable. It looks like that even the information stored in the registry cannot be trusted :

PRINT "Product Name = ", _
REGSTRING$(HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName")
#2
Tips & Tricks / Re: Detect if running Windows 11
April 01, 2025, 04:00:54 AM
This method was proposed by Nidud, author of the Asmc assembler :

DIM hMod AS HMODULE
DIM pNTHeaders AS PIMAGE_NT_HEADERS

hMod = GetModuleHandle("kernel32.dll")

pNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)hMod + ((PIMAGE_DOS_HEADER)hMod)->e_lfanew)

PRINT "Major Operating System Version =", pNTHeaders->OptionalHeader.MajorOperatingSystemVersion
PRINT "Minor Operating System Version =", pNTHeaders->OptionalHeader.MinorOperatingSystemVersion

My output :

Major Operating System Version = 6
Minor Operating System Version = 1

The minor version of Windows 11 is 0.
#3
Hi Kevin,

This one works without any issues :

DIM AnyType[3] AS INT_PTR
AnyType[0] = (INT_PTR) "This is %s %u."
AnyType[1] = (INT_PTR) "test"
AnyType[2] = (INT_PTR) 1
BCX_DYNACALL("msvcrt", "printf", 3, AnyType)

PRINT "All should be OK."

No need of the inline assembly code balancing the stack.
#4
Hi Kevin,

Thanks for the new release. Let's assume that BCX_DYNACALL calls a C function. It's the caller's responsibility to balance the stack after calling a C function. Maybe, you could add a new function like BCX_DYNACALL_C for this purpose.

A quick example :

DIM AnyType[3] AS INT_PTR
AnyType[0] = (INT_PTR) "This is %s %u."
AnyType[1] = (INT_PTR) "test"
AnyType[2] = (INT_PTR) 1
BCX_DYNACALL("msvcrt", "printf", 3, AnyType)

$CCODE
 __asm
{
    add esp, 3*4
}
$CCODE

PRINT "All should be OK."

The code will crash as the stack is unbalanced after returning back from BCX_DynaCall :

        mov    eax, offset @1357
        mov    dword ptr [_AnyType+4H], eax
        mov    dword ptr [_AnyType+8H], 1
        push    offset _AnyType
        push    3             
        push    offset @1359 
        push    offset @1358 
        call    _BCX_DynaCallA
        add    esp, 16  <--- This line       
        add    esp, 12  <--- and this line
#5
Tips & Tricks / Re: Terminate running process
March 16, 2025, 04:42:20 AM
Hi Quin,

Did you also try the 64-bit version? Probably, an insue related with my system as I compile and run the C++ equivalent of MrBcx's code without any problem.
#6
User Contributions / Re: Windows SysLink Example
March 14, 2025, 04:22:28 PM
Hi Kevin,

Checking the box for BED's DPI /Manifest resource file worked, thanks.
#7
User Contributions / Re: Windows SysLink Example
March 14, 2025, 03:50:23 PM
During an Ollydbg session to find where is the issue, the status of the stack before calling CreateWindowExA :

00E0FE70   00000000  |ExtStyle = 0
00E0FE74   00408014  |Class = "SysLink"
00E0FE78   0040CEFC  |WindowName = "Visit the BCX Basic website <A HREF="https://www.BcxBasicCoders.com">click here</A>"
00E0FE7C   56000000  |Style = WS_CHILD|WS_CLIPSIBLINGS|WS_CLIPCHILDREN|WS_VISIBLE
00E0FE80   00000014  |X = 14 (20.)
00E0FE84   00000014  |Y = 14 (20.)
00E0FE88   00000258  |Width = 258 (600.)
00E0FE8C   00000064  |Height = 64 (100.)
00E0FE90   000803F8  |hParent = 000803F8 ('Windows SysLink Demonstration',class='Windows SysLink Demonstration')
00E0FE94   0000270F  |hMenu = 0000270F
00E0FE98   00400000  |hInst = 00400000
00E0FE9C   00000000  \lParam = NULL


eax returns 0 after calling CreateWindowExA :

LastErr

ERROR_CANNOT_FIND_WND_CLASS (0000057F)
#8
User Contributions / Re: Windows SysLink Example
March 14, 2025, 03:11:34 PM
Hi Kevin,

Thanks for the code. Testing the application on Windows 11 2024 H2, I get a blank window wihout hyperlink control. The title of the window is "Windows SysLink Demonstration"

Code built with BCX Version 8.2.5 and PellesC V12

#9
Tips & Tricks / Re: Terminate running process
March 14, 2025, 12:57:40 PM
#10
Tips & Tricks / Re: Terminate running process
March 13, 2025, 03:21:04 PM
Hi Kevin,

I tried your new example at work on a Windows 11 2024 H2 system and it worked without any issues. Thanks for your help, much appreciated.
#11
Tips & Tricks / Re: Terminate running process
March 12, 2025, 04:12:58 PM
Hi Kevin,

Many thanks for your code. Testing the application on Windows 7 Sp1 64-bit, the 64-bit version of the application is crashing after displaying the report. No issue with the 32-bit version.
#12
Tips & Tricks / Re: Terminate running process
March 11, 2025, 04:24:43 PM
Hi Kevin,

A script proposed by ChatGPT :

' VBScript to display command line of a specific process using Win32_Process class
Option Explicit

' Specify the process name here (e.g., "notepad.exe")
Dim processName
processName = "chrome.exe"

' Create WMI object to access system information
Dim objWMIService, colProcessList, objProcess
Dim strQuery

' Set the WMI query to get processes with the specified name
strQuery = "SELECT * FROM Win32_Process WHERE Name = '" & processName & "'"

' Connect to WMI service
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")

' Execute the query and get the collection of processes
Set colProcessList = objWMIService.ExecQuery(strQuery)

' Check if any processes were found
If colProcessList.Count = 0 Then
    WScript.Echo "No processes found with the name: " & processName
Else
    ' Loop through each process and display its command line
    For Each objProcess In colProcessList
        WScript.Echo "Process ID: " & objProcess.ProcessID
        WScript.Echo "Command Line: " & objProcess.CommandLine
        WScript.Echo "-------------------------"
    Next
End If

' Cleanup
Set objWMIService = Nothing
Set colProcessList = Nothing


Executing the script :

cscript cmdline.vbs
#13
Tips & Tricks / Re: Terminate running process
March 11, 2025, 02:08:01 PM
Hi Kevin,

Trying this one :
Sql$ = "select CommandLine from win32_process where name=" + Cmd$

SET wmi = GetObject("winmgmts:")
SET result = wmi.ExecQuery(Sql$)

FOR EACH instance IN result
  PRINT instance
NEXT


D:\BCX\bed\test.c(1353): error #2051: Cast from 'OBJECT (aka struct _OBJECT)' to 'double' is invalid.
D:\BCX\bed\test.c(1353): error #2141: Type error in argument 2 to 'printf'; 'void' is invalid.
#14
Tips & Tricks / Re: Terminate running process
March 10, 2025, 04:12:40 PM
Hi Kevin,

Sorry for asking, how to change your code to display the command line parameters of a specific process? The win32_process class is providing a property named CommandLine :

https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process

Pseudo-code :

Sql$ = "select * from win32_process where name=" + Cmd$

SET wmi = GetObject("winmgmts:")
SET result = wmi.ExecQuery(Sql$)

FOR EACH instance IN result
  PRINT instance.CommandLine
NEXT

or
Sql$ = "select CommandLine from win32_process where name=" + Cmd$

SET wmi = GetObject("winmgmts:")
SET result = wmi.ExecQuery(Sql$)

FOR EACH instance IN result
  PRINT instance
NEXT

#15
Wish List / Re: 64-bit VBS_ Functions
March 10, 2025, 01:15:47 PM
Hello,

TablacusScriptControl is a very nice project. Sadly, they are going to retire VBScript :

https://techcommunity.microsoft.com/blog/windows-itpro-blog/vbscript-deprecation-timelines-and-next-steps/4148301

I hope we can find a way to install TablacusScriptControl after this retirement.