Mastering Reverse Engineering

Calling APIs

Calling APIs within our program just requires us to define the library file where the API function is, and the API name itself. As we did with our Hello World program, we import the API function by setting it up in the import section:

section '.idata' import data readable writeable     ; import section has read and write permissions  library kernel32, 'kernel32.dll', \               ; functions came from kernel32 and msvcrt dlls          msvcrt, 'msvcrt.dll'  import kernel32, ExitProcess, 'ExitProcess'       ; program will use ExitProcess and printf functions  import msvcrt, printf, 'printf'

And then we call the APIs with a CALL instruction, as follows:

    call [printf]    call [ExitProcess]