The following sample x86 assembly code gets the Terminal Services Session ID associated with the current process:
mov eax,fs:[00000018]
mov eax,[eax+0x30]
mov eax,[eax+0x1d4]
#1 Nice one. Probably explains why Win98 crashes a lot.
Brings back memories of when I coded in x86 assembler on an original IBM PC 8086. (I think it was actually an 8088? with an 8 bit data bus processor instead of 16 bit that the 8086 has). I understand EAX being segment register ES and register AX but the reference to an FS register. What is this? A new segment register not in the original 8086?
The code appears to look up an address of the address of the Terminal Services Session ID whatever that is!
#2 It is not machine code. It is assembler. Machine code looks like this: 85 4F 2B 5F 7E ie hex numbers. What that does on an x86 processor I don't know as I've made the numbers up!
Please post links to new released Win APIs.
http://www.lee.ic24.net/
This post was edited by Smiviz on Wednesday, August 28, 2002 at 06:00.
|