I am trying to translate a code made in c into assembler (fasm) and I can't get it to work, the code tries to create an entry in the registry so that when the machine starts it is executed

Code in C (it works perfectly):

#include <windows.h>
#include <string.h>

int main(int argc, char* argv[]) {
  HKEY hkey = NULL;
  
  const char* exe = "C:\\2022-05-14-program\\init.exe";

  // startup
  LONG res = RegOpenKeyEx(HKEY_CURRENT_USER, (LPCSTR)"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0 , KEY_WRITE, &hkey);
  if (res == ERROR_SUCCESS) {
    // create new registry key
    RegSetValueEx(hkey, (LPCSTR)"hack", 0, REG_SZ, (unsigned char*)exe, strlen(exe));
    RegCloseKey(hkey);
  }
  return 0;
}

Code in ASM/FASM (it does not work):

    .data
      hkey      dd      0
      exe       db      'C:\2022-05-14-program\init.exe'
      cad       db      'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
      name      db      'hack2',0

      KEY_WRITE         = 0x00020006
      HKEY_CURRENT_USER = 80000001h
      REG_SZ            = 1
start :
      push hkey    ; Address of DWORD for the handle value.
      push KEY_WRITE
      push 0
      push cad
      push HKEY_CURRENT_USER
      push [RegOpenKeyEx]

      push 30      ; Equivalent "SIZE" in fasm?
      push exe
      push REG_SZ
      push 0
      push name
      push [hkey]  ; The actual handle value (not its address!)
      call [RegSetValueEx]

      push [hkey]
      call [RegCloseKey]

      push 0       ; Errorlevel.
      call [ExitProcess]
.end start

I can see that it loads perfectly in the C code but not with the ASM code, for this I consult it with the following PowerSehell command

reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s

Compiles perfectly but no log entry is generated, I hope someone helps me.

CodePudding user response：

Instead of push [RegOpenKeyEx] you should call [RegOpenKeyEx].

Also look at your data in debugger. Windows API expects single backslash in path, check whether your assembler uses \ as an escape character, like C does.

I have tried it in my toolchain and it worked:

; Source saved as pabeni.asm
; Created with "euroasm.exe pabeni.asm"
; Debugged with "ollydbg.exe pabeni.exe"
; Checked with "regedt32.exe"
       EUROASM
pabeni PROGRAM FORMAT=PE, ENTRY=start
[.data]
      hkey      dd      0
      exe       db      'C:\2022-05-14-program\init.exe'
      cad       db      'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
      name      db      'hack2',0
KEY_WRITE         = 0x00020006
HKEY_CURRENT_USER = 80000001h
REG_SZ            = 1
      IMPORT RegOpenKeyExA,RegSetValueExA,RegCloseKey,LIB=Advapi32.dll
      IMPORT ExitProcess,LIB=kernel32.dll
[.text]
start:
      push hkey       ; Address of DWORD for the handle value.
      push KEY_WRITE
      push 0
      push cad
      push HKEY_CURRENT_USER
      call RegOpenKeyExA

      push SIZE# exe ; 30 characters. Not zero-terminated.
      push exe
      push REG_SZ
      push 0
      push name
      push [hkey]   ; The actual handle value (not its address!)
      call RegSetValueExA
      push [hkey]
      call RegCloseKey
      push 0   ; Errorlevel.
      call ExitProcess
     ENDPROGRAM pabeni

CodePudding user response：

I finally solved it, I attach the code:

.data
      hkey      dd      0
      exe       db      'C:\2022-05-14-program\init.exe',0
      cad       db      'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
      name      db      'hackoll'
start :
      push hkey    ; Address of DWORD for the handle value.
      push KEY_WRITE
      push 0
      push cad
      push HKEY_CURRENT_USER
      call [RegOpenKeyEx]

      push exe
      call[lstrlen]

      push eax
      push exe
      push REG_SZ
      push 0
      push name
      push [hkey]  ; The actual handle value (not its address!)
      call [RegSetValueEx]

      push [hkey]
      call [RegCloseKey]

      push 0       ; Errorlevel.
      call [ExitProcess]
.end start  

Thank you all very much for your enormous effort in helping :)