0

I try to analyze malware since a few months and by examining the assembly code of a trojan for example, I see sometimes windows functions like ws2_32.send which is the send()-function, etc. That is not a problem to understand, I can go to:

http://msdn.microsoft.com/de-de/library/windows/desktop/ms740149%28v=vs.85%29.aspx

and read that, everything is okay.

But I ask myself, how the people who writes that code put that function in their code. I mean, can you for example write in a C code the function

  int send(
     __in  SOCKET s,
     __in  const char *buf,
     __in  int len,
     __in  int flags);

and is it then so that the C compiler understands it ? There are some other functions like CopyFileA for example which looks like:

  BOOL WINAPI CopyFile(
  _In_  LPCTSTR lpExistingFileName,
  _In_  LPCTSTR lpNewFileName,
  _In_  BOOL bFailIfExists
  );

Here I ask myself how the compiler understand the word "WINAPI" for example and so on.

In general, if the people try to write such code to create a trojan, how they make clear that it should be a windows function?

4

You're misunderstanding the use of the keyword. As the comment on your questions said, WINAPI is the calling convention for a function. WINAPI is #define'd to __stdcall which specifies how the stack is managed in relation to that function, which you can see documented on MSDN here. That article gives you a good overview of what it does and how it would get used in the header file.

It's common for the calling convention to not be explicitly stated for CRT functions on Windows; but that's just in the documentation and doesn't mean the calling convention doesn't need to be declared similarly. Most functions (on x86) will use __stdcall. The most common exception is the printf() family of functions which use the cdecl calling convention. This has more to do with the history of how x86 was developed than any particular design choices.

Most constants, WINAPI et al, can be found somewhere on MSDN or if you have Visual Studio by hitting F12.

Now as far as a more general answer to what I take your question to be, as far as how/why you might see certain function calls in a particular sample, the short answer is that Windows provides both the standard C library calls and its own versions of the APIs. In this case, the send() function is defined in Winsock2.h and the function itself is in Ws2_32.lib (also available on that MSDN page you linked). However, what you might call the "Windows API version" of this function is also found in the same .h and .lib file: WSASend(), which is documented here.

You can see by the two articles on MSDN these functions are almost identical, and if you look at the disassmebly for both of them you'd see that WSASend() and send() are almost the exact same function. But Windows supports both so if you learn on Unix or just using the standard C library you can write the same code on windows.

Most of the other CRT functions (fopen, fread, printf) are implemented in the C Runtime Library, msvcrt.dll. They're mostly independent (compared to socket functions all being in Ws2_32.lib).

|improve this answer|||||
2

WINAPI is a declaration in the .h files for __stdcall... (ie. standard call type declaration parameters passed on stack and function is expected to balance the stack as opposed to the __cdecl format, or __fastcall).

And, the compiler does the work for you on the imports:

BOOL WINAPI CopyFile(
_In_  LPCTSTR lpExistingFileName,
_In_  LPCTSTR lpNewFileName,
_In_  BOOL bFailIfExists
);

push TRUE ; assume the `bFailIfExists` is set to `true` - compiler looks up
          ; the equate for true which is typically 01 
          ; (unless you're coding in Delphi, then its strange).

push offset lpNewFilename ; compiler sets this as a unique address, linker fixes it up.

push offset lpExistingFileName ; same as above

call [__imp__CopyFile] ; linker fixes this up to the address in the import table

Oh, in asm ; is a comment like // in c. asm example... params are pushed in the opposite order.

Put simply, regardless of the coding language various things equate to a value, which the compiler knows or sees that its set in the code, the compiler makes the obj files which are compiled code, but addresses are set in a sort of lookup table format, uniquely, imports are declared, but again, name or ordinal style table.

Then, the linker does the task of putting everything together for the final executable, further stuff is done if its a DLL, like reloc tables and such

actually its declared here.. look at the #declare WINAPI line near the bottom

http://msdn.microsoft.com/en-us/library/zxk0tw93.aspx

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.